# Task-Oriented Adversarial Attacks for Aspect-Based Sentiment Analysis Models
## 6 Experimental Results and Analysis  
Table 1 presents the results obtained from the defined adversarial attacks. These results were obtained by running the target model ten times, with the average values reported. To measure the quality of adversarial examples, the semantic similarity between the original input \(x\) and the modified input \(x^{\prime}\) was measured using cosine similarity. The results presented correspond to the ABAA attack when the terms were selected and filtered using a threshold of \(\beta=0.4\), as this configuration yielded the best results. Through the white-box attack, we observed the effectiveness of our proposal, its negative impact on the model's accuracy, and the quality of the generated adversarial examples. The results obtained from this attack (as shown in Table 1) demonstrate the feasibility of our ABAA model and attack approach. The ABAA attack achieved a significant reduction in accuracy of 65.30% in the victim model while preserving a high semantic similarity of 92.20% between the original opinions (\(x\)) and adversarial examples (\(x^{\prime}\)). Furthermore, we observed that the attack required minimal modifications, with a perturbation ratio of only 7.79%. Comparing the performance of our white-box attack with baseline 1, our method achieves a 22.5% greater reduction in accuracy and demonstrates superior semantic \begin{table}
\begin{tabular}{l l l c c c c c} \hline \hline  & **DNN** & **Dataset** & \begin{tabular}{c} **Before-Attack** \\ **Accuracy** \\ \end{tabular} & **Attack** & \begin{tabular}{c} **After-Attack** \\ **Accuracy** \\ \end{tabular} & \begin{tabular}{c} **Accuracy** \\ **Reduction** \\ \end{tabular} & \
\begin{tabular}{c} **Perturbation** \\ **Ratio** \\ \end{tabular} &
\begin{tabular}{c} **Semantic** \\ **Similarity** \\ \end{tabular} \\ \hline \multirow{2}{*}{White-Box} & \multirow{2}{*}{CNN} & \multirow{2}{*}{Laptop} & \multirow{2}{*}{95.91} & Baseline 1 & 53.06 & 42.80 & 64.19 & 92.6 \\  & & & & ABAA & 30.61 & 65.30 & 7.79 & 97.2 \\  & & & & Baseline 1 & 72.68 & 7.53 & 37.62 & 85.3 \\ \multirow{2}{*}{Gray-Box} & \multirow{2}{*}{CNN} & \multirow{2}{*}{Restaurant} & \multirow{2}{*}{80.21} & ABAA & 69.34 & 10.87 & 19.96 & 94.9 \\  & & & & ABAA & 15.05 & 65.70 & 14.52 & 98.7 \\ \multirow{2}{*}{Black-Box} & \multirow{2}{*}{BERT} & \multirow{2}{*}{Laptop} & \multirow{2}{*}{76.82} & Baseline 2 & 11.02 & 65.80 & 13.00 & 92.0 \\ \multirow{2}{*}{Black-Box} & \multirow{2}{*}{BERT} & \multirow{2}{*}{Laptop} & 76.82 & Baseline 3 & 26.67 & 50.15 & 15.40 & 89.0 \\ \multirow{2}{*}{Black-Box} & \multirow{2}{*}{BERT} & \multirow{2}{*}{Laptop} & 76.82 & Baseline 4 & 22.06 & 54.76 & 14.51 & 83.0 \\ \multirow{2}{*}{Black-Box} & \multirow{2}{*}{BERT} & \multirow{2}{*}{Laptop} & 76.82 & Baseline 5 & 22.22 & 54.60 & 16.80 & 85.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Results obtained from the proposed adversarial attacks, including before-attack (BA) and after-attack (AA) accuracy, perturbation ratio (PR), and semantic similarity (SS) of the generated adversarial examples. similarity, outperforming baseline 1 by 5.4 percentage points. These results support our hypothesis that the modification of terms associated with specific aspects can significantly degrade model accuracy with minimal and straightforward modifications. To further illustrate the importance of modifications aligned with the evaluated aspects, Table 2 presents examples of opinions and their corresponding successful adversarial examples generated using (1) baseline 1 and (2) the proposed ABAA model. For each opinion (\(x\)), we include the evaluated aspect, the semantic similarity (SS) between the original opinion and its adversarial example (\(x^{\prime}\)), the perturbation ratio (PR), and whether any aspect terms were changed (ATC). The adversarial examples presented emphasize the value of aspect-based modifications. The aspect-based adversarial examples generated by our model demonstrate high quality, achieving minimal modifications while maintaining strong semantic similarity.