Pay Attention to the Robustness of Chinese Minority Language Models! Syllable-level Textual Adversarial Attack on Tibetan Script
Year: 2023

Abstract:
The textual adversarial attack refers to an attack method in which the attacker adds imperceptible perturbations to the original texts by elaborate design so that the NLP (natural language processing) model produces false judgments. This method is also used to evaluate the robustness of NLP models. Currently, most of the research in this field focuses on English, and there is also a certain amount of research on Chinese. However, to the best of our knowledge, there is little research targeting Chinese minority languages. Textual adversarial attacks are a new challenge for the information processing of Chinese minority languages. In response to this situation, we propose a Tibetan syllablelevel black-box textual adversarial attack called TSAttacker based on syllable cosine distance and scoring mechanism. And then, we conduct TSAttacker on six models generated by fine-tuning two PLMs (pre-trained language models) for three downstream tasks. The experiment results show that TSAttacker is effective and generates high-quality adversarial samples. In addition, the robustness of the involved models still has much room for improvement.

heading: 1 Introduction
text: With the development of neural network models, methods based on the models have been widely used in many fields and achieved remarkable performance, such as computer vision, speech recognition, and natural language processing. However, neural network models are susceptible to adversarial attacks (Szegedy et al., 2013).
When textual adversarial attacks are performed on the NLP models for classification tasks, the models with high robustness will make predictions consistent with the original texts after perturbation, while the models with low robustness will make incorrect predictions. Section 2 will detail the current research status of textual adversarial attacks on
* Corresponding author.
English and Chinese. The information processing technology of Chinese minority languages started late, but in recent years, the emergence of Chinese minority PLMs has promoted development but brought new challenges, one of which is textual adversarial attacks. However, there is little research on this topic.
The main contributions of this paper are as follows:
(1) To fill the research gap of textual adversarial attacks on Tibetan script, this paper proposes TSAttacker, a Tibetan syllable-level black-box textual adversarial attack with a high attack success rate. This attack method can significantly reduce the accuracy of the models and generate adversarial samples with a low average Levenshtein distance.
(2) To evaluate the robustness of the Tibetan part in the first Chinese minority multilingual PLM, this paper conducts TSAttacker on six models generated by fine-tuning two versions of the PLM for three downstream tasks. During fine-tuning, we also find that training sets conforming to language standards can improve model performance.
(3) To facilitate future explorations, we opensource our work on GitHub (https://github. com/UTibetNLP/TSAttacker). We call on more researchers to pay attention to the security issues in the information processing of Chinese minority languages.

heading: 2 Related Work

heading: 2.1 Textual Adversarial Attacks on English
text: At present, most of the research on textual adversarial attacks concentrates on English. Jia and Liang (2017) first proposed generating adversarial samples for English public datasets and evaluating NLP models from a robustness perspective. Since then, various English textual adversarial attack methods with different strategies have emerged. According to the granularity of text perturbations, attacks can
35
be classified into character-, word-, and sentencelevel (Du et al., 2021).
Character-level attacks are operations that perturb the characters of the original text, including adding, deleting, modifying, and changing the order of characters. Ebrahimi et al. (2018) proposed a character-level white-box attack method called HotFlip based on the gradients of the one-hot input vectors, Gao et al. (2018) proposed a greedy algorithm based on scoring called DeepWordBug for character-level black-box attacks, Eger et al. (2019) proposed a character-level white-box attack method called VIPER based on visual similarity, and so on.
Word-level attacks are to perturb the words of the original text, and the main method is word substitution. Such as, Jin et al. (2019) proposed a wordlevel black-box attack method called TextFooler which combines the cosine similarity of words with the semantic similarity of sentences, Garg and Ramakrishnan (2020) proposed a word-level black-box attack method based on the BERT mask language model called BAE, and Choi et al. (2022) proposed TABS, an efficient beam search wordlevel black-box attack method.
Sentence-level attacks generate adversarial sentences primarily through paraphrasing and text generation, which often result in a significant gap between the perturbed text and the original text. Moreover, it is difficult to control the quality of generated adversarial samples. The attack effect is also relatively average (Zheng et al., 2021).

heading: 2.2 Textual Adversarial Attacks on Chinese
text: The methods of generating adversarial texts are closely related to language characteristics, such as textual features and grammatical structure. Therefore, there are different methods of generating adversarial samples for various languages. The research on Chinese textual adversarial attacks started later than English, but there are also some related studies. Wang et al. (2019) proposed a Chinese word-level black-box attack method called WordHanding, which designed a new word importance calculation algorithm and utilized homonym substitution to generate adversarial samples. Tong et al. (2020) proposed a Chinese word-level blackbox attack method called CWordAttacker, which used the targeted deletion scoring mechanism and substituted words with traditional Chinese and Pinyin. Zhang et al. (2022) proposed a Chinese
character-level black-box attack method called PGAS, which generated adversarial samples with minor disturbance by replacing polyphonic characters. The relevant research on Chinese textual adversarial attacks is not sufficient, and the language features of Chinese are not fully integrated. So, there is still a lot of exploration space.

heading: 2.3 Textual Adversarial Attacks on Chinese Minority Languages
text: With the construction and development of information technology in Chinese minority areas like Inner Mongolia, Tibet, and Xinjiang, the corpus of Chinese minority languages has reached a certain scale. Recently, there have been some PLMs targeting or containing Chinese minority languages. It is worth mentioning that Yang et al. (2022) proposed CINO (Chinese mINOrity PLM), the first Chinese minority multilingual PLM, covering standard Chinese, Cantonese, Tibetan, Mongolian, Uyghur, Kazakh, Zhuang, and Korean. This model achieves SOTA (state-of-the-art) performance on multiple monolingual or multilingual datasets for text classification, significantly promoting the NLP research of Chinese minority languages.
Meanwhile, Morris et al. (2020) released an English textual adversarial attack frame called TextAttack, Zeng et al. (2021) released a textual adversarial attack toolkit called OpenAttack which supports both English and Chinese, Wang et al. (2021) released a robustness evaluation toolkit called TextFlint for English and Chinese NLP models, etc. These have provided a good research platform for other languages’ textual adversarial attacks and model robustness evaluation.
However, to the best of our knowledge, there is little research involving textual adversarial attacks on Chinese minority languages such as Mongolian, Tibetan, and Uyghur. Without robustness evaluation, the NLP models with low robustness will face serious risks, such as hacker attacks, poor user experience, and political security problems, which pose a huge threat to the stable development and information construction of Chinese minority areas. Therefore, we should take precautions to study the textual adversarial attack methods of related languages and evaluate the robustness of related models to fill in the gaps in related research fields.

heading: 3 Attack Method

heading: 3.1 Textual Adversarial Attacks on Text
text: Classification
For a K-class classification dataset D = {(xi, yi)}ni=1, where x ∈ X (X includes all possible input texts) and y ∈ Y (Y includes all K classifications). The classifier F obtains the classification ytrue corresponding to the original input text x, denoted as
F (x) = argmax y∈Y
P (y|x) = ytrue. (1)
The attacker achieves a successful textual adversarial attack by elaborately designing the adversarial text x′ and making
F (x′) = argmax y∈Y P (y|x′) ̸= ytrue, (2)
where x′ is the result of adding ϵ-bounded, imperceptible perturbations δ to the original text x.

heading: 3.2 TSAttacker Algorithm
text: Tibetan is a phonetic script consisting of 30 consonant letters and 4 vowel letters. These letters are combined into Tibetan syllables according to certain rules. A Tibetan word is composed of one or more syllables separated by tsheg ( ). Therefore, it is different from English and Chinese in that the syllable granularity in Tibetan is between character and word. Let the syllable in the original input text x be s (ignore tsheg and end-of-sentence punctuation), then
x = s1s2 . . . si . . . sn. (3)
In this work, we propose a Tibetan syllable-level black-box textual adversarial attack called TSAttacker based on syllable cosine distance and scoring mechanism. We adopt syllable cosine distance to obtain syllables for substitution and a scoring mechanism to determine the order of syllable substitutions.

heading: 3.2.1 Syllable Substitution
text: Grave et al. (2018) released high-quality pretrained word vectors for 157 languages, including Tibetan syllable embeddings, which were trained using fastText1 (Joulin et al., 2016) on the dataset composed of a mixture of Wikipedia and Common Crawl. The Tibetan training result contains some
1https://fasttext.cc
unwanted vectors due to the nature of the training dataset, such as embeddings of “MP3", “PNG", and “File". Consequently, we cleaned the result and obtained 7,652 Tibetan syllable embeddings basically containing all commonly used syllables.
For each Tibetan syllable s in the original input text x, we use all syllables whose embedding’s cosine distances from the embedding of s are within the range of (0, dmax] as a candidate syllables’ set C. Let the cosine distance between the embedding of s and the embedding of s′ (s′ ∈ C) be d, then d satisfies the following condition:
d = 1− s · s ′
|s| · |s′| ≤ dmax. (4)
By adjusting dmax, we can control the similarity between all syllables in set C and syllable s. The smaller dmax is, the more similar all syllables in set C are to syllable s. As a result, the size of set C can be adjusted. The larger dmax, the larger the size of set C.
For the i-th Tibetan syllable si in the original input text x, there is always a candidate syllables’ set Ci corresponding to it. Assuming that the size of set Ci is m. We select a candidate syllable si′ from set Ci each time, and
xi ′ = s1s2 . . . si′ . . . sn. (5)
At the same time, we calculate
∆Pi = P (ytrue|x)− P (ytrue|xi′). (6)
After iterating set Ci, the syllable si∗ can be found, and
xi ∗ = s1s2 . . . si∗ . . . sn. (7)
At the moment,
∆Pi ∗ = P (ytrue|x)− P (ytrue|xi∗) (8) = max{∆Pij}mj=1 = max{P (ytrue|x)− P (ytrue|xi′j)}mj=1,
si ∗ = arg max si′∈Ci {∆Pij}mj=1 (9)
= arg max si′∈Ci
{P (ytrue|x)− P (ytrue|xi′j)}mj=1.
The syllable si∗ obtained in this way can cause the most significant change in the classification probability after substitution and have the best attack effect. Therefore, we use syllable si∗ to substitute syllable si.
The pseudocode of the TSAttacker algorithm is as shown in Appendix A.

heading: 3.2.2 Substitution Order
text: Word saliency (Li et al., 2016) refers to the degree of change in the classification probability after a word is set to unknown (out of vocabulary). Here, we use it to calculate syllable saliency. For the i-th Tibetan syllable si in the original input text x, we set it to “< UNK >", and
x̂i = s1s2 . . . < UNK > . . . sn. (10)
Then, we calculate the saliency of syllable si as Si:
Si = P (ytrue|x)− P (ytrue|x̂i). (11)
We incorporate the scoring formula in the probability weighted word saliency algorithm (Ren et al., 2019) to determine the substitution order of syllables in the original input text x. The score Hi is defined as follows:
Hi = Softmax(Si) ·∆Pi∗ (12)
= eSi
Σnj=1e Sj ·∆Pi∗.
From the above formula, it can be seen that the score Hi comprehensively considers the importance of the substituted syllable si and the substitution syllable si∗. After sorting n scores {H1, H2, . . . ,Hn} corresponding to the original input text x in descending order, we sequentially substitute si with si∗. If F (x′) ̸= F (x), the attack succeeds, and if always F (x′) = F (x), the attack fails.

heading: 4 Experiment

heading: 4.1 Datasets and Models

heading: 4.1.1 Datasets
text: Table 1 lists the detailed information of the datasets: TNCC-title, TNCC-document, and TU_SA, including task, number of classes, the average number of syllables, etc.
TNCC1. Qun et al. (2017) open-sourced the Tibetan News Classification Corpus (TNCC) collected from the China Tibet Online website (http: //tb.tibet.cn). This corpus consists of two parts: TNCC-title, a news title classification dataset, and TNCC-document, a news document classification dataset. TNCC-title is a short text dataset with 9,276 samples and an average of 16 syllables per title. TNCC-document is a long
1https://github.com/FudanNLP/ Tibetan-Classification
text dataset with 9,204 samples and an average of 689 syllables per document. There are twelve classes both in TNCC-title and TNCC-document dataset: Politics, Economics, Education, Tourism, Environment, Language, Literature, Religion, Arts, Medicine, Customs, and Instruments.
TU_SA2. TU_SA is a Tibetan sentiment classification dataset consisting of 10,000 samples labeled as positive or negative, with 5,000 samples in each class. Zhu et al. (2023) selected 10,000 sentences from the public Chinese sentiment analysis datasets: weibo_senti_100k and ChnSentiCorp, then manually translated and proofread by professional researchers to form this dataset.

heading: 4.1.2 Models
text: The existing public PLMs targeting or containing Tibetan include the monolingual PLM TiBERT (Liu et al., 2022) based on BERT (Devlin et al., 2019) and the multilingual PLM CINO (Yang et al., 2022) based on XLM-R (Conneau et al., 2020), and CINO has achieved SOTA performance in relevant evaluations on Tibetan. We adopt two versions of CINO: cino-base-v23 and cino-large-v24, then fine-tune them for the three downstream tasks corresponding to the above datasets. Each dataset is split into a training set, a validation set, and a test set according to a ratio of 8:1:1. We select the best checkpoints based on the macro-F1 score for TNCC and the F1 score for TU_SA. The hyperparameters used for downstream fine-tuning are listed in Table 2.
It should be noted that the texts in TNCC have been pre-tokenized, which means that a space instead of a tsheg has been added between two syllables. When Yang et al. (2022) fine-tuned CINO on TNCC, they removed the spaces, but the processed texts do not conform to the standards of Tibetan script, and there should be a tsheg between two syllables. Therefore, we make a separate experiment that fine-tunes models on texts with a space between two syllables, texts with no space between two syllables, and texts with a tsheg between two syllables. The results of the validation sets are listed in the first 12 rows of Table 3 and show that models fine-tuned on the texts conforming to language standards can achieve better performance.
Table 3 list the performance of the models fine-tuned on TNCC and TU_SA. We
2https://github.com/UTibetNLP/TU_SA 3https://huggingface.co/hfl/cino-base-v2 4https://huggingface.co/hfl/cino-large-v2
adopt the following six models as victim models and conduct TSAttacker on the test sets: cino-base-v2+TNCC-title(tsheg), cinobase-v2+TNCC-document(tsheg), cino-largev2+TNCC-title(tsheg), cino-large-v2+TNCCdocument(tsheg), cino-base-v2+TU_SA, and cino-large-v2+TU_SA.

heading: 4.2 Evaluation Metrics and Experiment Results
text: We use Accuracy Drop Value (ADV) and Attack Success Rate (ASR) to evaluate both the attack effectiveness and the model robustness, and Levenshtein Distance (LD) to evaluate the quality of a generated adversarial sample. ADV refers to the difference in the model accuracy on the test set between pre-attack and post-attack. ASR refers to the percentage of the attack that successfully fool the victim model. The larger ADV or ASR, the more effective the attack and the less robust the model. LD refers to the minimum number of single-syllable edits between two texts, like insertions, deletions, and substitutions. The smaller LD, the higher the quality of the generated adversarial sample.
In this work, we set the maximum cosine distance dmax to 0.2929, in other words, the maximum angle between two syllable embeddings is 45◦. We use this parameter to determine the set of candidate substitution syllables according to Equation 4. Table 4 shows the experiment results and Appendix B lists some adversarial samples generated by TSAttacker.
The results show that our proposed attack method TSAttacker greatly reduces the model accuracy and has a high attack success rate, which shows the effectiveness of the attack method. For the dataset TNCC-title, the accuracy of the models cino-base-v2 and cino-large-v2 decreases by 0.3646 and 0.3430, and the attack success rate reaches 0.7605 and 0.7487, respectively; for the dataset TNCC-document, the accuracy of the models cino-base-v2 and cino-large-v2 decreases by 0.3859 and 0.3283, and the attack success rate reaches 0.7120 and 0.6696, respectively; for the dataset TU_SA, the accuracy of the models cinobase-v2 and cino-large-v2 decreases by 0.2240 and 0.2660, and the attack success rate reaches 0.6380 and 0.6570, respectively.
From a certain point of view, the robustness of Chinese minority NLP models still has much room for improvement. The model cino-base-v2 is a base version of CINO, with 12 layers, 768 hidden states, and 12 attention heads. The model cino-large-v2 is a large version of CINO, with 24 layers, 1024 hidden states, and 16 attention heads. However, for different datasets, the same attack method does not always achieve a higher attack success rate on the smaller model, and the larger model is not always the one with a smaller accuracy drop value. This seems to indicate that the model robustness is independent of the model size.
The results also show that our proposed attack method TSAttacker can generate high-quality adversarial samples because of the low average Levenshtein distance. The average number of syllables
in the datasets TNCC-title, TNCC-document, and TU_SA is 16, 689, and 28. For the dataset TNCCtitle, the average Levenshtein distance of the generated adversarial samples on the models cino-basev2 and cino-large-v2 is 1.6411 and 1.7176, respectively; for the dataset TNCC-document, the average Levenshtein distance of the generated adversarial samples on the models cino-base-v2 and cinolarge-v2 is 39.1800 and 41.9660, respectively; for the dataset TU_SA, the average Levenshtein distance of the generated adversarial samples on the models cino-base-v2 and cino-large-v2 is 2.9404 and 2.7017, respectively. Several examples in Appendix B intuitively demonstrate that the model’s prediction transforms from one high-confidence classification to another after conducting TSAttacker.

heading: 4.3 Ablation Experiment
text: Since our experiments involve an artificially set parameter, the maximum cosine distance dmax, we explore the influence of dmax on various evaluation metrics through ablation experiments as follows. We set dmax to 0.1340, 0.2929, and 0.5, respectively, that is to say, we set the maximum angle between two syllable embeddings to 30◦, 45◦, and 60◦ to get the set of candidate substitution syllables, then we conduct TSAttacker on the six models. Figure 1 shows the results of the ablation experiments in the form of line charts. From the line charts, we can intuitively find that the larger dmax, the larger accuracy drop value and attack success rate,
and the relationship between dmax and average Levenshtein distance is not significant. Although the larger dmax, the more effective the attack, the similarity between the substituted syllable and the substitution syllable may not be that high.

heading: 5 Discussion

heading: 5.1 Textual Adversarial Attack is a Major Threat
text: Recently, Wang et al. (2023) evaluated the adversarial robustness of ChatGPT and found that the absolute performance of ChatGPT is far from perfection even though it outperforms most of the counterparts. Nowadays, more and more applications based on the services of foundation models appear, making various downstream scenarios face the risk of textual adversarial attacks worryingly. They also found that some small models achieve better performance on adversarial tasks while having much fewer parameters than the strong models. Therefore, there is still great space for research on the robustness and interpretability of neural network models.

heading: 5.2 Pay Attention to the Robustness of Chinese Minority Language Models
text: The textual adversarial attack is a new challenge for Chinese minority languages’ information processing, which poses a major threat to the stable development and information construction of Chinese minority areas. China is a unified multi-ethnic
country. Due to the late start of information processing technology for Chinese minority languages, there is little research on the textual adversarial attack and defense of Chinese minority languages nowadays. With the development of neural network models, research in this field is now urgent.
From an attack perspective. The attack method proposed in this paper only preliminarily explores the field and evaluates the robustness of the Tibetan part in the first Chinese minority multilingual PLM. Moreover, the attack methods combined with the linguistic characteristics of Chinese minority languages need to be further proposed.
From a defense perspective. The overall performance of Chinese minority PLMs, including robustness, is far worse than that of English and Chinese PLMs. The main reason is that there is a huge gap in the quantity level between the corpus of Chinese minority languages and the corpus of English and Chinese. Therefore, this problem
should be alleviated first. In addition, in response to the proposed textual adversarial attacks, a posterior defense is also an effective method.

heading: 6 Conclusion
text: In this work, we propose a Tibetan syllable-level black-box textual adversarial attack called TSAttacker. In TSAttacker, the syllable cosine distance is used to obtain syllables for substitution, and the scoring mechanism is used to determine the order of syllable substitutions. We conduct TSAttacker on six models generated by fine-tuning two versions of the PLM CINO for three downstream tasks. The experiment results show that TSAttacker greatly reduces the model accuracy and has a high attack success rate. Also, the adversarial samples generated by TSAttacker are high-quality. From a certain point of view, the robustness of the models still has much room for improvement.

heading: Acknowledgements
text: We would like to express our sincere gratitude to the following funding sources for their support of this article: the “New Generation Artificial Intelligence" major project of Science and Technology Innovation 2030 (No. 2022ZD0116100), the National Natural Science Foundation of China (No. 62162057), and the Mount Everest Discipline Construction Project of Tibet University (Project No. zf22002001).
Limitations
Our work only preliminarily explores the field of textual adversarial attack on Chinese minority languages and evaluates the robustness of the Tibetan part in the first Chinese minority multilingual PLM. The textual adversarial attack is a major threat in the information processing of Chinese minority languages. We hope our attack method, experiment results, and discussions could provide experience for future research. In the future, we will continue to concentrate on the security issues faced in Tibetan information processing.
Ethics Statement
The purpose of this paper is to show that our proposed attack method is effective and the robustness of the SOTA Chinese minority PLM CINO still has much room for improvement, but not to attack it intentionally. Finally, we call on more researchers to pay attention to the security issues in the information processing of Chinese minority languages.

heading: A Pseudocode of TSAttacker Algorithm
text: Algorithm 1: TSAttacker Algorithm Input: Classifier F . Input: Original text x = s1s2 . . . si . . . sn. Input: Maximum cosine distance dmax. Output: Adversarial text x′.
1 for i← 1 to n do 2 x̂i ← s1s2 . . . < UNK > . . . sn // Equation 10 3 Si ← P (ytrue|x)− P (ytrue|x̂i) // Equation 11 4 end 5 Init H as a empty list. 6 for i← 1 to n do 7 Get the candidate syllables’ set Ci according to syllable si and dmax. 8 m← len(Ci) 9 for j ← 1 to m do
10 si ′ ← Cij 11 xi ′ ← s1s2 . . . si′ . . . sn // Equation 5 12 ∆Pi ← P (ytrue|x)− P (ytrue|xi′) // Equation 6 13 end 14 ∆Pi
∗ ← max{∆Pij}mj=1 // Equation 8 15 si
∗ ← argmaxsi′∈Ci{∆Pij}mj=1 // Equation 9 16 Hi ← e Si
Σnj=1e Sj ·∆Pi∗ // Equation 12
17 Append (si∗, Hi) into H . 18 end 19 Sort H by the second parameter in descending order. 20 foreach element in H do 21 x′ ← s1s2 . . . si∗ . . . sn 22 if F (x′) ̸= F (x) then 23 Attack succeeds and return x′. 24 end 25 end 26 Attack fails and return.

heading: B Some Generated Adversarial Samples
text: Model Input Output (pre-attack)
Output (post-attack)
cino-large-v2+ TNCC-title
(tsheg)
Education (92.95%)
Economics (97.35%)
cino-large-v2+ TNCC-document
(tsheg)
Economics (91.24%)
Environment (99.86%)
cino-large-v2+ TU_SA
Negative (94.74%)
Positive (99.91%)
Substituted syllables are marked in bold and red. Substitution syllables are in parentheses.

heading: Future Work