# A Survey of Adversarial Attacks: An Open Issue for Deep Learning Sentiment Analysis Models
## 3 Adversarial Attacks on Sentiment Analysis
### Black Box and Gray Box Adversarial Attacks  
Black box attacks do not require the details of the neural networks, although they can access the input and output. This type of attack often relies on heuristics to generate adversarial examples, and is more practical in real-world applications. * [PERSON] et al. [35] exploited the paraphrasing strategy to create semantically equivalent adversarial examples (SEA). They generated paraphrases of an input text \(x\) and observed the model predictions from \(f(x^{\prime})\) until the original prediction was modified. To control the generation of paraphrases, the authors defined an indicator function \(SemEq(x,x^{\prime})\) that is 1 if \(x\) is semantically equivalent to \(x^{\prime}\) and 0 otherwise. They defined a semantically equivalent adversary (SEA) as a semantically equivalent instance that changes the model prediction: \[SEA(x,x^{\prime})=1[SemEq(x,x^{\prime})\wedge f(x)\
eq f(x^{\prime})].\] (6) To generate adversarial samples, a set of paraphrases \(\Pi x\) around \(x\) was generated via beam search to obtain predictions on \(\Pi x\) using the victim model until an adversary was found or until \(S(x,x0)<\tau\). Additionally, a semantic equivalent rule-based method was proposed to generalize adversarial examples to understand and correct the failures when generating paraphrases. The rule takes the form \(r=(a\to c)\), where the first instance of the antecedent \(a\) is replaced by the consequent \(c\) for every instance \(x\) that includes \(a\). The authors generated SEAs and proposed rules for every \(x\in X\). * [PERSON] et al. [36] proposed the DeepWordBug method for generating small text perturbations in a black box environment. In this method, the _Replace-1 Score (R1S)_, _Temporal Head Score (THS)_, _Temporal Tail Score (TTS)_, and _Combined Score (CS)_ punctuation strategies are used to identify key terms that cause the classifier to make an incorrect prediction when modified. Character-level transformations can then be performed on the most relevant terms to minimize the edit distance of the perturbation from the original input. * [PERSON] et al. [37] presented the TextFooler method, which uses the fundamental NLP tasks of text classification and textual entailment to generate adversarial examples. When provided with a sentence, the proposed approach selects the words that most significantly influence the final prediction results through a selection mechanism that measures the influence of a word \(w_{i}\in X\) on the classification result \(F(X)=Y\). Each word is removed from the sentence one at a time in order to calculate the word importance, then the prediction score for label \(Y\) is measured. The importance score \(I_{ui}\) is then calculated as the prediction change before and after deleting the word \(w_{i}\). When the words with a high importance score have been obtained, they are replaced by the closest synonyms according to the cosine similarity between \(w_{i}\) and every other word. The proposed attack was evaluated on CNN and LSTM architectures, including pretrained BERT. * [PERSON] et al. [39] presented a gray box adversarial attack and defense framework which consists of a generator \(\varsigma\) (updated) and two copies of a pretrained target classifier: a static classifier \(C\) and an updated/augmented classifier \(C^{*}\). During the training phase, the output of \(\varsigma\) is directly fed to \(C\) and \(C^{*}\) to form a joint architecture. Post-training, the generator \(\varsigma\) is used independently to generate adversarial examples (adversarial attack), while the augmented classifier \(C^{*}\) is an improved classifier with increased robustness (adversarial defense).