# A Hybrid Adversarial Attack for Different Application Scenarios +
## 4 Experiments
### Evaluation
#### 4.2.2 White-Box Attack with the Coefficient of Variation  
Our experimental goal is to generate adversarial examples to confuse the classifier. As long as the prediction result of the adversarial example is different from the original comment result, the attack is considered successful. At the same time, we need to exclude the influence of classifier accuracy on the experimental results, so we select 500 correctly classified examples. Our experiments have the same word distance threshold and word replacement rate, the word Euclidean distance is set at 50 and the word replacement rate is set at 0.1, and k is set at 35 in the greedy attack. Finally, we add cosine distance experiments for greedy attack and global attack. We calculate the attack success rate corresponding to several different cosine distance thresholds. The experimental results are shown in Figure 2. We can see that the smaller the cosine distance is, the higher the success rate the attack will have because the word angle is larger and their similarity is smaller. Greedy attack and global attack without cosine distance had original success rates of 65.8% and 75.8%. In the global attack, there is increased cosine distance, even if the cosine distance is set to 0.9848; the final success rate will increase to 77.4%, while the greedy attack has no new successful \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & **GA** & **F = 0.1** & **F = 0.3** & **F = 0.5** & **F = 1.2** & **F = 1.5** \\ \hline
10\% modified & 58.5\% & 63\% & 62.5\% & 56.5\% & 55\% & 53\% \\
20\% modified & 91\% & 96\% & 94.5\% & 94.5\% & 96\% & 97.5\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Attack success rate with different word modifiers and F values. \begin{table}
\begin{tabular}{l} \hline \hline Original Text Prediction = **Positive**. \\ \hline absolutely fantastic whatever i say wouldn’t do this underrated movie the justice it \\ deserves watch it now fantastic. \\ \hline Adversarial Text Prediction = **Negative**. \\ \hline absolutely fantastic whatever i say wouldn’t do this underestimated movie the justice it \\ deserve watch it now fantastic. \\ \hline Original Text Prediction = **Negative**. \\ \hline poorly directed short film shot on hi def or betacam it appears it screams student film \\ video all the way the premise is limited in scope and the short actually feels a lot \\ longer than it runs some interesting acting moments and some decent production \\ value but not enough to lift this film from the hole it has fallen into. \\ \hline Adversarial Text Prediction = **Positive**. \\ \hline poorly directed gunshot film shot on hi def or betacam it appears it shrieks student film \\ video all the way the premises is limited in scope and the short actually feels a lot \\ longest than it runs some interesting acting moments and some decent production \\ value but not enough to lift this film from the hole it has fallen in. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Original text and adversarial example of black-box attack. examples. There is no significant change in the number of increases between the cosine of 0.9848 and 0.6428. An angle of more than 0.6428 will have a significant increase in the number of successful attacks. In addition, we do an experiment to find candidate words only by cosine distance as a contrast. We find that, in the case of high cosine distance threshold, the attack success rate is very low, but finally when the cosine distance threshold is 0, it can also achieve a high attack success rate, which shows, that in terms of word similarity, the effect of cosine distance is worse than that of European distance. We can use the cosine distance as a supplement of European distance to improve the overall attack success rate. The evaluation of adversarial examples shows that greedy attack still shows that the replacement locations are sometimes close, or even in the front of the text, for which readability is not good, while the replacement position of global attack is relatively random.