# Task-Oriented Adversarial Attacks for Aspect-Based Sentiment Analysis Models
## 2 Preliminaries  
The design of adversarial examples is motivated by one of two objectives: attack or defense. Adversarial attacks aim to examine the robustness of the target model (or victim model) by introducing modified inputs, while adversarial defenses use the knowledge of adversarial examples to strengthen it. In this work, we observe adversarial attacks on aspect-based sentiment analysis models (ABSA models).  
An adversarial attack consists of generating adversarial examples to mislead the target model and negatively impact its accuracy. Formally, an adversarial example \(x^{\prime}\) is generated by adding a small modification \(n\) to the original deep learning input \(x\), that is, \(x^{\prime}=x+n\). Ideally, a robust model would correctly classify \(x^{\prime}\) into the correct class \(y\), while a victim model is expected to misclassify \(x^{\prime}\). The objective of adversarial examples is to deviate the classification label to an incorrect one (\(f(x^{\prime})\
eq y\)) or a specified one (\(f(x^{\prime})=y^{\prime}\)). [PERSON] et al. [10] proposed a formalization of adversarial examples as follows:  
\[f(x)=y,\ x\in X \tag{1}\] \[x^{\prime}=x+n,\ f(x^{\prime})\
eq y\]  
where \(X\) is the input dataset \(x\in X\), and \(n\) is the worst-case perturbation. Ideally, modifications to create adversarial examples should be minimally perceptible to humans but capable of misleading deep learning (DL) models.  
Adversarial examples were first introduced by [PERSON] et al. [9] in evaluating the robustness of image-based deep neural networks (DNNs). However, similar methods cannot be directly applied to text-based DNNs due to three principal differences: (i) input space, where images are continuous, but text data are discrete; (ii) perceptibility, as minor changes in image pixels are less perceptible than textual modifications; and (iii) semantics, where even minimal modifications in text can significantly alter its meaning. For text inputs, proposed works have adjusted the modification process to maintain the semantics of inputs, as well as the imperceptibility of the modifications made [6; 16; 20; 21]. In text applications, adversarial examples (or adversarial texts) can be generated by modifying inputs at the level of character, word or sentence, applying techniques such as replacing, deleting, adding, or swapping text elements [12; 22; 23]. Advanced strategies include paraphrasing, appending distractor text, or introducing grammatical errors such as verb conjugation changes, negations, or antonym substitutions [8; 15; 24].  
Depending on the knowledge of the target model to be attacked, three types of adversarial attacks can be performed: black-box, white-box, and gray-box. Black-box attacks are performed without any knowledge of the architecture or parameters of the victim model. In contrast, white-box attacks are based on the complete knowledge of the technical details of the model. Lastly, gray-box attacks are performed with partial target knowledge, typically limited to model training data [25].  
To maintain minimal modifications and preserve the input semantics, it is important to carefully design, measure, and control adversarial example generation. Modification sizes are often measured using metrics such as the edit distance, Jaccard coefficient, word mover's distance (WMD), or the perturbation ratio. Semantic preservation is evaluatedusing measures of distance (for example, Euclidean distance) and similarity (for example, cosine similarity) between word vectors [21].  
Typically, the effectiveness of an adversarial attack is measured by comparing the accuracy of the model before and after the attack, referred to as the accuracy before the attack (BA) and the accuracy after the attack (AA) [26]. In addition, the attack success rate is evaluated, which indicates the proportion of successful adversarial examples and provides information on the susceptibility and robustness of the model [21].