# Task-Oriented Adversarial Attacks for Aspect-Based Sentiment Analysis Models
If modifications are made without considering these relations, irrelevant terms may be modified, affecting the semantics of the text input and the readability of the message, impacting the modification's imperceptibility, and, in some cases, not achieving the objective of misleading the model. Furthermore, not considering task-specific characteristics during input modification leaves potential vulnerabilities unaddressed, for which effective defenses cannot be proposed. We consider that modifications for generating adversarial examples should be designed by considering the specific task characteristics to modify the critical elements that support the input classification (according to the observed task). For aspect-based analysis, generating adversarial examples requires modifying terms associated with aspectsto disrupt the aspect term relations learned by the DL model, thus altering classification results. In this context, we previously introduced a model specifically designed to generate adversarial examples for aspect-based analysis [18]. This model incorporates the specific characteristics of aspect-based tasks to define the input modifications, achieving a successful misleading of aspect-based models with minimal input alterations. By modifying the fundamental terms to the task, the adversarial examples disrupt the model's task-understanding rather than how it understands the features of text inputs. Previous results have demonstrated the feasibility and potential of the model to advance adversarial example generation in aspect-based analysis. In this work, we extend the evaluation of our adversarial example generation model by focusing on three key aspects: (1) its effectiveness in decreasing model accuracy, (2) its independence from specific contexts across diverse domains, and (3) its transferability, ensuring that the negative impact persists when applied to different models. To achieve this evaluation, we propose three adversarial attacks specifically designed for aspect-based sentiment analysis. These attacks involve different victim models, considering different levels of model knowledge (white-box, gray-box, and black-box) to drive input modifications. We compare the performance of our proposed attacks against a general document-level adversarial attack and a recently introduced method to generate adversarial examples oriented to aspect-based sentiment analysis [19]. The results obtained demonstrate the importance of designing adversarial examples that consider the characteristics of the target task. Our approach outperformed the document-level attack in the negative impact on model results, despite using a simple synonym substitution for input modifications. Furthermore, when compared to the state-of-the-art method, our proposed attacks achieve superior overall performance by requiring fewer modifications while still effectively decreasing model accuracy. We summarize the main contributions of this work as follows:  
* A model for the generation of adversarial examples. The model for generating adversarial examples emphasizes the significance of creating adversarial instances through task-specific modifications observed in deep learning models. In our approach, we focus on aspect-level analysis; however, this adversarial example generation model can be applied to other text-based tasks by following the same methodology, disrupting the essential components that enable task classification. * Introduction of three adversarial attacks: We propose three adversarial attack strategies (white-box, gray-box, and black-box) specifically designed for aspect-based sentiment analysis. These attacks focus on modifying the input while taking into account the characteristics of the task. * Comprehensive evaluation of our model: We conducted an evaluation of our previously proposed adversarial example model [18], evaluating it in various adversarial attack strategies. The evaluation involved diverse dataset domains, different model architectures, and different levels of knowledge about the victim models.