# Task-Oriented Adversarial Attacks for Aspect-Based Sentiment Analysis Models  
[PERSON]  
1 Department of Computer Science, National Institute for Astrophysics, Optics and Electronics, [PERSON] #1, Sta Maria Tonanzimtia, Puebla 72840, Mexico; [EMAIL_ADDRESS] (M.V.-H.); [EMAIL_ADDRESS] (L.V.-P.);  
2  
[PERSON]  
3 Tecnologico Nacional de Mexico (TECNM), Instituto Tecnologico Superior de Libres, Camino Real esq. Camino Cuauthentome, Barrio de Teleta, Ciudad de Libres, Puebla 73780, Mexico; mariana.l@libres. on user attitudes, facilitating decision-making processes for both potential users and organizations [2]. According to the information needs, the sentiment analysis can be conducted at different levels of granularity: document, sentence, or aspect. Document-level analysis involves processing a complete text to classify it as positive or negative [3]. Sentence-level analysis, on the other hand, focuses on individually processing and classifying the sentiment of each sentences within a document [4]. Aspect-level analysis, also known as aspect-based sentiment analysis (ABSA), represents a more detailed approach, providing fine-grained information on specific components, features, or attributes of a product, service, or topic [5]. The aspect-based analysis (we will use the term \"aspect-based\" hereafter to mean aspect-level analysis) is a detailed process that requires methods to accurately identify the opinions expressed for each evaluated aspect within a document or sentence. In recent years, deep learning (DL) algorithms have increasingly been employed to enhance the performance of aspect-based analysis, aiming to improve the accuracy of traditional algorithms and increase the user and organization confidence in decision-making processes. However, these algorithms could not always guarantee consistent results. Different research works, such as [6; 7; 8; 9], have demonstrated that deep learning (DL) models are susceptible to being misled by adversarial examples, leading to classification errors. Adversarial examples are inputs that have been deliberately modified through minimal perturbations designed to (i) mislead DL models on input understanding to cause incorrect results or (ii) enhance the robustness of DL models by introducing new knowledge and capabilities [10]. The concept of adversarial examples was first introduced by the authors of [9] when they studied the stability of deep neural networks (DNNs) used for image classification. Their study revealed that DNNs could be misled with high probability through modified input, causing misclassification, even when the changes were imperceptible to humans. Modified inputs were called adversarial examples; since then, this denomination has been applied to any input data intentionally modified to mislead deep learning models. In the context of text-based tasks, ref. [8] explored adversarial examples to evaluate DNNs and observed that text DNNs could be fooled by modified inputs. Subsequent research related to text-based tasks [11; 12; 13; 14] has demonstrated that textual DNNs can be misled through modifications at character, word, or sentence level by adding, removing, substituting, or swapping parts of the text inputs. Recent studies on adversarial examples oriented to sentiment analysis have demonstrated their ability to successfully mislead deep learning (DL) models for this task [6; 15; 16; 17]. However, most of the existing works have approached the sentiment analysis as a document-level analysis without considering the specific characteristics and objectives of each analysis level, resulting in non-optimal input modifications that do not achieve the desired purpose of the adversarial examples. For example, in aspect-based analysis, the aspects evaluated in an opinion are closely related to specific terms that define the user's attitude. For this reason, it is important to consider the relation between aspects to accurately identify the opinions associated with each aspect.