# Universal Adversarial Attack via Conditional Sampling for Text Classification
## 4 Experiments
### Evaluation Metrics  
In order to facilitate the evaluation of our attack performance, we randomly selected 500 correctly classified samples in the data set according to the positive and negative categories as the test input. We evaluated the performance of the attack model, including the composite score, the attack success rate, attack effectiveness, and the quality of adversarial examples. The details of our evaluation indicators are listed in Table 1. We will describe these evaluation indicators in detail.  
Figure 4: Overview of our attack. At each step, we concatenate the current trigger to a batch of examples. Then, we sample sentences conditioned on the loss value and classification accuracy computed for the target adversarial label over the batch from a BERT language model.  
(1) The attack success rate is defined as the percentage of samples incorrectly predicted by the target model to the total number of samples. In this experiment, these samples are all connected to the universal trigger. The formula is defined as follows  
\[S=\frac{1}{N}\sum_{i=1}^{N}(f(t,x_{i})\
eq y_{i}), \tag{6}\]  
where \(N\) is the total number of samples, \(f\) represents the target model, \(t\) represents the universal trigger, \(x_{i}\) represents the \(i\)th test sample, and \(y_{i}\) represents the actual label of \(x_{i}\).  
(2) We divide it into four parts for the quality of triggers, including word frequency [29], grammaticality, fluency, and naturality [23]. The average frequency of the words in the trigger is calculated using empirical estimates from the training set of the target classifier.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Metrics** & **Evaluation Method** & **Better?** \\ \hline Composite score & Auto & Higher \\ Success Rate & Auto & Higher \\ Word Frequency & Auto & Higher \\ Grammaticality & Auto (Error Rate) & Lower \\ Fluency & Auto (Perplexity) & Lower \\ Naturality & Human (Naturality Score) & Higher \\ \hline \hline \end{tabular}
\end{table}
Table 1: Details of evaluation metrics. “Auto” and “Human” represent automatic and human evaluations respectively. “Higher” and “Lower” mean the higher/lower the metric, the better a model performs.  
Figure 5: BiLSTM framework.  
The higher the average frequency of a word, the more times the word appears in the training set. Grammaticality is measured by adding triggers of the same number of words to benign text, and then using an online grammar check tool (Grammarly) to obtain the grammatical error rate of the sentence. With the help of GPT-2 [14], we utilize Language Model Perplexity (PPL) to measure fluency. Naturalness reflects whether an adversarial example is natural and indistinguishable from human-written text.  
(3) We construct a composite score \(Q\) to comprehensively measure the performance of our attack method. The formula is defined as follows  
\[Q=\lambda\cdot S+\mu\cdot W-\
u\cdot G-\delta\cdot P \tag{7}\]  
where \(S\) is the attack success rate of the trigger, \(W\) is the average word frequency of the trigger, \(G\) is the grammatical error rate of the trigger, and \(P\) is the perplexity of the GPT-2 [14]. \(W,G,P\) are all normalized. \(\lambda,\mu,\
u,\delta\) is the coefficient of each parameter, and \(\lambda+\mu+\
u+\delta=1\). In order to balance the weight of each parameter, we set \(\lambda\), \(\mu\), \(\
u\) and \(\delta\) to 0.25. The higher the \(Q\) score, the better the attack performance.  
To further verify that our attack is more natural than the baseline, we conducted a human evaluation study. We provide 50 pairs of comparative texts. Each team contains one trigger and one baseline trigger (with or without benign text). Workers are asked to choose a more natural one, and humans are allowed to choose an uncertain option. For each instance, we collected five different human judgments and calculated the average score.