# Task-Oriented Adversarial Attacks for Aspect-Based Sentiment Analysis Models
## 5 Experimental Setup  
To evaluate our proposal, including the model and attack methods, we used different victim models and datasets from various domains, all centered around the task of aspect-based sentiment analysis. Victim models involve different architectures, including the BERT autoencoder. The selected datasets are from multiple domains and include opinions with varying characteristics, such as the number of aspects evaluated, the length of terms per opinion, and the total number of opinions within each dataset. The integration of diverse datasets and various architectures enables us to evaluate the generality and context-independence of our proposed approach. * Victim model 1 [34]. The proposed model implements a CNN architecture as a deep learning model. CNN incorporates a combination of kernels with sizes 1, 2, and 3 in  
Figure 4: Black-box aspect-based adversarial attack overview. Figure 3: Gray-box aspect-based adversarial attack overview. the convolutional layer to generate various feature maps. The specific settings for the convolutional layer include the following: activation function = ReLU; pool size = max length--kernel size + 1; and strides = 1. The general configuration includes the following: epochs = 9; filters = 256; dropout rate = 0.5; activation function = sigmoid; loss function = binary cross-entropy; and optimizer = Adam. * Victim model 2 [35]. The proposed model implements a BiLSTM and BERT-base model. The target model for English (BERT-base) uses 16 layers of transformer blocks with a hidden size of 768 and 12 self-attention heads. The general configuration includes the following: BertAdam optimizer; \(max_{selen}\) = 80; epochs = 10; learning rate = 2 \(\times\) 10\({}^{-5}\); and batch size = 16. For the experiments, we used two aspect-based datasets released in the SemEval workshop [36] from the Laptop and Restaurant domains. These datasets include opinions labeled with the respective evaluated aspects and the sentiment expressed for each. Both datasets are in English and have already been partitioned into training and testing subsets. Both datasets were selected to facilitate a comparison of our proposal with state-of-the-art attack methods:  
* Dataset 1. The Restaurant dataset is composed of two subsets: (1) a training set containing 2507 reviews and (2) a test set comprising 889 reviews. Both subsets include customer reviews annotated with the identified aspects and their corresponding sentiment polarities. The dataset categorizes sentiment into four classes: positive, negative, neutral, and conflict. * Dataset 2. The Laptop dataset is composed of two subsets: (1) a training set containing 2328 reviews and (2) a test set comprising 49 reviews. Both subsets include customer reviews annotated with the identified aspects and their corresponding sentiment polarities. The dataset categorizes sentiment into three classes: positive, negative, and neutral. To evaluate and compare the effectiveness of our approach, we established two baseline models as follows:
* Baseline 1. This baseline is designed to evaluate the results of the white-box and gray-box ABAA attacks. In this case, we use the same victim model employed in the white-box and gray-box attacks and follow a similar modification process. To generate adversarial examples, opinion terms to be modified are defined if they are included in sentiment lexicons, without considering whether they are related to the aspects evaluated. The selected terms are then replaced with their most semantically similar synonyms. * Baseline 2. For the black-box attack, we compare our results from the attacks with those reported by [PERSON] et al. [19], since this existing method of attack already integrates specific characteristics at the aspect level to generate adversarial examples. Additionally, to compare our ABBA black-box attack with state-of-the-art approaches, we established the following baselines, where the attack methods were specifically designed to target BERT models.