Misleading Relation Classifiers by Substituting Words in Texts
Year: 2023

Abstract:
Relation classification is to determine the semantic relationship between two entities in a given sentence. However, many relation classifiers are vulnerable to adversarial attacks, which is using adversarial examples to lead victim models to output wrong results. In this paper, we propose a simple but effective method for misleading relation classifiers. We first analyze the most important parts of speech (POSs) from the syntax and morphology perspectives, then we substitute words labeled with these POS tags in original samples with synonyms or hyponyms. Experimental results show that our method can generate adversarial texts of high quality, and most of the relationships between entities can be correctly identified in the process of human evaluation. Furthermore, the adversarial examples generated by our method possess promising transferability, and they are also helpful for improving the robustness of victim models.

heading: 1 Introduction
text: Relation Extraction (RE) is to extract relationships contained in the text. It is an important part of Information Extraction (IE), and it is widely used in knowledge graph construction, information retrieval, and Q&A systems. Relation classification is an important link in the process of RE, and it aims to predict a relation between two entities in a sentence (Lyu and Chen, 2021). In most cases, the information of entities in samples has already been given (e.g., by manual marking), thus, the effect of relation classification will directly influence the overall performance of RE.
Deep Learning (DL) models have advantages in Natural Language Processing (NLP) tasks, but many Pre-trained language models are still facing potential threats from adversarial attacks (Wang et al., 2022). To check and further improve the robustness of DL models, there already exist diverse
∗Corresponding author
methods to generate adversarial examples currently. Moreover, the mechanisms of finding vulnerable places (tokens to be manipulated potentially) in texts and choosing perturbation types (e.g., Substitution, Insertion, Deletion, etc.) are gradually refined. However, some methods (Ren et al., 2019; Li et al., 2019) need to rank the importance of each word in finding vulnerable places, and some methods (Ebrahimi et al., 2018; Alzantot et al., 2018) ignore the characteristics of different parts of speech (POSs), so they treat each token in texts equally. Most of them need additional prerequisites (such as pre-trained models for word transformation) more or less in the process of implementation, and the essence (some POSs are more important than others in nature) of perturbing those words is seldom talked about in these works.
In this paper, we present a rule-based method1 for generating adversarial texts against relation classification. We first analyze the most important POSs from the perspective of linguistics. To make small changes in original samples and avoid grammar mistakes, our method finds synonyms or hyponyms for tokens labeled with the most important POS tags, and it chooses words that have a great impact on the classification results of victim models. We conduct experiments on 2 datasets and generate adversarial examples against 3 classification models. Compared with other related studies, our method can generate samples of higher quality. These adversarial texts preserve the original relationships between entities well (relationships contained in 85.3% of the texts can be correctly judged by all 12 volunteers at the same time), and they also perform well in the experiment that studied transferability. Besides, an average of 71.59% adversarial examples can be correctly classified after retraining victim models using updated training sets (containing 5000 adversarial examples).
1Code, data, and models are available at https://github. com/JiangTianJason/Substitution_based_Attack
3770

heading: 2 Related Work
text: According to the target of perturbation imposed on input samples, the Textual Adversarial Attacks can be divided into 4 levels (Zeng et al., 2021), including Character-Level, Word-Level, Character/Word-Level, and Sentence-Level.
Character-Level. Methods (Gao et al., 2018; He et al., 2021) in Character-Level add perturbations to change the characters of important words. However, texts generated by these methods are usually with more grammar mistakes and are easy to be recognized as adversarial examples by human beings.
Word-Level. Probability Weighted Word Saliency (Ren et al., 2019) (PWWS) uses the word saliency (Li et al., 2016) strategy to determine the replacement order, and follows the order to substitute words with synonyms that have the greatest impact on output until the output change. Similar to PWWS, Genetic (Alzantot et al., 2018) (Gen) is also a score-based method for constructing adversarial examples. It uses the Perturb Subroutine to select the best replacement word, and employs the genetic algorithm to find successful adversarial examples with fewer modifications. To better retain sentence semantics, the masked-languagebased attacks (Garg and Ramakrishnan, 2020; Li et al., 2020) replace or insert words based on their context.
Character/Word-Level. HotFlip (Ebrahimi et al., 2018) (HF) uses the gradient of models to estimate the change in loss, and it uses beam search to find a set of operations for creating white-box adversarial examples. Similar to HF, TextBugger (Li et al., 2019) (TB) is also a gradient-based method for creating adversarial texts in both white-box and black-box settings, and it provides more (5) options for manipulating characters/words in sentences.
Sentence-Level. Like methods in (Iyyer et al., 2018; Ribeiro et al., 2018), most Sentence-Level methods paraphrase texts using pre-trained models, and the syntactic changes between original and adversarial texts are usually significant.
For a better understanding of model robustness, DiagnoseAdv (Li et al., 2021b) leverages the salience-based analysis of adversarial examples, and it finds spurious correlation (between perturbed tokens and predicted labels) and Out-OfDistribution (OOD, which means perturbed tokens do not appear in the training set) are the two main reasons for the incorrect output of victim models.

heading: 3 Methodology

heading: 3.1 Preliminary
text: According to the theory of syntax (Chomsky, 2014), a sentence can be divided into several constituents based on the different relationships between words, and there are 8 constituents (Subject, Predicate, Object, Predicative, Object Complements, Attributive, Adverbial, Appositive) which compose multiple sentence types (Simple Sentence, Compound Sentence, and Complex Sentence, etc.). Figure 1 shows the syntactic functions of some words or structures (phrases, clauses, etc.) perform in sentences.
From Figure 1, we can see Nouns appear more frequently than other types of words or structures. Since Predicate is a core constituent, we can treat Verbs as important as Nouns. Besides, Adjectives also appear in multiple types of constituents. Thus, the changes in Nouns, Verbs, and Adjectives have a higher possibility of leading relation classifiers to output wrong results.
Luckily, the definition of lexical morphemes in morphology (Yule, 2020) can support the correctness of the above analysis results. Lexical morphemes (including Nouns, Verbs, Adjectives, and Adverbs) can be used to express specific things, qualities, states, or actions, and provide the main meaning of a phrase or sentence. Besides, the above analysis results also explain why Nouns, Verbs, Adjectives are Top-3 POS tags in three perturbation types (Li et al., 2021a).

heading: 3.2 Proposed Method
text: To generate adversarial examples and mislead victim classifiers, we propose a rule-based method to substitute tokens in original samples. The 2 main steps of our method are as follows: (1) tagging all tokens with POSs and filtering tokens, (2) finding and adjusting substitution words for each token. Finally, we pick out words that have the greatest impact on the output, and substitute tokens with these words. Algorithm 1 describes how to modify tokens in original samples using our method.
In Algorithm 1, x represents the original sample, which contains all tokens (T ), the first (h) and second entity (t), and the labeled relation (rel) between two entities. L is a set which contains types of tokens (Noun, Verb, etc.) to be modified. The victim model V can output the inference result (relationship rel) and confidence (conf ) at the same time. Forbidden set F contains words that need to be skipped in processing, such as linking verbs
(e.g., “is” and “are”), etc., and it can be customized by attackers manually.

heading: 3.2.1 Tagging and Filtering
text: Tagging tokens with POSs. The basis of our method is to tag all tokens with POSs accurately, and line 2 in Algorithm 1 shows this process. In daily use, there are 9 POSs (Verbs, Nouns, Adjectives, Adverbs, Determiners, Prepositions, Pronouns, Conjunctions, Interjections) which help us make a sentence, and NLTK (Bird et al., 2009) provides 36 tags2 to label the above 9 POSs more specifically.
Filtering tokens. We use the condition (line 4 in Algorithm 1) to pick out tokens that meet our demands. Since our method can filter out most of the irrelevant tokens which are semantically meaningless, there is no need to rank the importance of tokens as in other studies, and we treat the reserved tokens equally.

heading: 3.2.2 Finding, Adjusting and Substituting
text: Finding and Adjusting substitution words. WordNet (Miller, 1998) can obtain all synonyms3
2https://www.ling.upenn.edu/courses/Fall_2003/ ling001/penn_treebank_pos.html
3WordNet uses the concept of cognitive synonyms (synsets) to group and find synonyms, and synsets are presented in the database with lexical and semantic relations.
or hyponyms4 of the target token (line 7 in Algorithm 1). To avoid making grammar mistakes, we use Pattern (De Smedt and Daelemans, 2012) to adjust substitution words. Since the specific tags of POS are given in step (1), we can change the inflection (tenses, singular or plural, comparative or superlative, etc.) of Verbs, Nouns, Adjectives, Adverbs according to the posk tag.
Substituting tokens. For each token, we replace it with one adjusted synonym or hyponym in each substitution attempt, and choose one word for the final substitution according to the feedback information (output of victim models on the modified sample). In Algorithm 1, we use the condition (rel′ ̸= rel) in line 9 to choose a word that completely changes the result of relation classification, or use the condition in line 11 to choose a word that changes the confidence of the victim model significantly in judging correct relations.

heading: 3.3 Complete Process
text: To illustrate the complete process of our method, we give an example in Figure 2.
As shown in Figure 2, we first label each token with pos tag. Then we filter out linking verb (part of F in Algorithm 1), two entities (“Mary”
4According to the hierarchical relationship between synsets in WordNet, the hyponyms sets of nouns and verbs can be found in the tree structure.
Algorithm 1: Generate an adversarial example by substituting tokens with synonyms or hyponyms Input: Sample: x; Types of tokens to be modified L; Victim model V . Output: Modified sample x′.
1 Initialize Forbidden set F , Entity set E = {h, t}, Relationship rel between h and t; 2 Get the POS tag posk for each token tk ∈ T = {t1, t2, . . . , tn}; 3 for each token tk ∈ T do 4 if posk ∈ L and tk /∈ F and tk /∈ E then 5 max←− None; score←− 0; ik ←− Get the index of token tk in sample x; 6 Get the confidence conf that the model V infers the relationship as rel; 7 Get the set Yk = {yk1, yk2, . . . , ykm} containing synonyms and hyponyms of token tk; 8 for each word ykn ∈ Yk do 9 y′kn ←− Adjust ykn according to the tag pos of token t; tk ←− y′kn; Get prediction result (rel′, conf ′) of sample x′ from V ; if rel′ ̸= rel then 10 return x′;
11 else if conf ′ − conf > score then 12 score←− conf ′ − conf ; max←− y′kn; Restore the token indexed as ik with tk;
13 tk ←− max;
and “Bob”, idx represents the index of the entity in sample) and other proper nouns (they are labeled with “NNP” in singular form or “NNPS” in plural form. However, they should not be perturbed for the sake of correctness5, but many related works6 usually ignore this). Next, we obtain synonyms and hyponyms of each chosen token, and adjust substitution words in order (adjust candidate words of “fascinated” according to the “VBN” tag). Words in the blue box have the most impact on victim models, and the values of confidence reduction are
5For example, despite “lingo” being one synonym of “language”, “natural lingo processing” does not represent a branch of computer science, and proper nouns are often something with a unique name.
6Method in (Tan et al., 2020), (Shi and Huang, 2020), etc.
shown behind each word. Thus, we substitute tokens with these adjusted words (since the Indefinite Article “an” precedes the Noun “expert”, we should choose “authority” that begins with a vowel).

heading: 4 Experiments and Analysis
text: To verify the effectiveness of our method, the experiments are conducted on 2 datasets, and 3 DL models are been used for the task of relation classification. Furthermore, we explore the most frequent POS tags of changed tokens in adversarial texts, and compare the similarity of syntactic structure between adversarial and original texts. To study the transferability, we cross-validate the attack effectiveness of adversarial examples against different
target models. Besides, we invite volunteers to evaluate the quality of adversarial texts, and use our adversarial examples to improve the robustness of victim models.

heading: 4.1 Datasets and Victim Models
text: Wiki80 (Han et al., 2018) and TACRED (Zhang et al., 2017) are two datasets used in the experiments. The Wiki80 dataset contains 80 relations derived from Wikipedia, and it has 50400 sentences for training, and 5600 sentences for validation (also for testing). TACRED (TAC Relation Extraction Dataset, a dataset built over newswire, broadcast material, and web text collected by Linguistic Data Consortium7) contains 42 relations, and 68124/22631/15509 samples for training/validation/testing separately.
OpenNRE (Han et al., 2019) is a unified framework (composed of Tokenization, Module, Encoder, Model, Framework parts) for relation extraction, and we pre-train Bert (Devlin et al., 2019), BertEntity (Baldini Soares et al., 2019), and PCNN (Zeng et al., 2015) in the Encoder module to embed text for providing semantic features. More implementation details are introduced in Section A.

heading: 4.2 Evaluation Metrics
text: We use Accuracy (Acc) to evaluate the performance of victim models. Accuracy is the percentage of correctly classified samples in all samples.
Attack Success Rate (ASR) is used to evaluate the attack effectiveness, and it is the percentage of samples successfully fooling models in all samples.
Formal Similarity (Dis), Semantic Similarity (Sem), Perplexity (Flu), Word Modification Rate (WMR) and Grammatical Errors (Err) are 5 metrics used for evaluating adversarial examples. Formal Similarity and Semantic Similarity are used for measuring differences between adversarial and original texts. Formal Similarity (Levenshtein et al., 1966) is measured by the Levenshtein edit distance, and Semantic Similarity is measured by the Universal Sentence Encoder (USE) (Cer et al., 2018). Besides, Perplexity (Radford et al., 2019) is a metric to evaluate the fluency of adversarial examples. Word Modification Rate is the percentage of changed tokens in all tokens, and Grammatical Errors are checked by Ginger8.
Table 1 lists the evaluation metrics and gives the judging criteria.
7https://catalog.ldc.upenn.edu/LDC2018T03 8https://www.gingersoftware.com

heading: 4.3 Results

heading: 4.3.1 Classification Performance
text: The training epoch of “Bert”, “BertEntity” and “PCNN” models are 20, 20, 200 separately, and the Accuracy of each model on the testing sets are shown in Table 2.
As shown in Table 2, although the classification performance of the “PCNN” model is not as good as that of “Bert” and “BertEntity” (especially when the number of relations is 80), “PCNN” can correctly classify the relation in 80.64% samples from the TACRED dataset, and the classification accuracy of other models are all 85% above.

heading: 4.3.2 Attack Performance
text: We choose Nouns (“N”), Verbs (“V”), Adjectives (“J”), and Adverbs (“R”) as target POSs (L in Algorithm 1), and we combine parts or all of the above word types to test our method in the subsequent experiments. Besides, we compare the attack performance with 4 methods (“PWWS”, “Gen”, “TB”, “HF”) which are introduced in Section 2. The average performance of these methods on 2 datasets are summarized in Table 3, and the complete experimental results are shown in Table 9, 10 and 11 in Appendix B.
As shown in Table 3, the attack effectiveness of our method is not as good as “PWWS” and “TB”, but better than that of other attacking methods. To achieve higher values of ASR, the minimum threshold value of substituting words is not set in our
Dataset MethodGen HF PWWS TB
Wiki80 NOUN: 51.7% NOUN: 35.9% NOUN: 61.5% NOUN: 55.7% VERB: 26.6% PREP: 21.5% VERB: 17.7% VERB: 18.6% ADJ: 15.0% VERB: 20.8% ADJ: 17.6% ADJ: 16.8% ADV: 4.0% ADJ: 10.7% ADV: 1.9% ADV: 3.0%
TACRED NOUN: 53.2% NOUN: 40.7% NOUN: 58.4% NOUN: 55.8% VERB: 28.2% VERB:19.3% VERB: 19.8% VERB: 20.6% ADJ: 12.1% PREP: 16.6% ADJ: 17.4% ADJ: 15.8% ADV: 4.6% ADJ: 11.8% ADV: 2.5% ADV: 3.1%
Table 4: Proportional distribution of Top-4 POSs.
method, thus the values on Semantic Similarity are a little inferior to “Gen”, but the overall quality of adversarial examples generated by our method is superior to that of “Gen” and others. Among our methods, the combination (“NVJR”) achieves the highest ASR, and the combination (“NV”) generates adversarial examples of the highest quality. Besides, the impact of adding Adverbs on the final results is not as great as that of adding Adjectives.

heading: 4.4 Further Analysis

heading: 4.4.1 POSs Analysis
text: We count the POS tags for perturbed words in 2 datasets, and then analyze the distribution of POSs. The Top-4 POSs and their proportional distribution are shown in Table 4.
We find that most of the adversarial attacks happen to Nouns, Verbs, and Adjectives in 3 methods (“Gen”, “PWWS”, “TB”), while Prepositions (PREP that appears in Table 4) are also under great attack in “HF”. In general, the results are consistent with the natural distribution of lexical patterns analyzed in Section 3.1.

heading: 4.4.2 Dependency Parsing
text: To evaluate our method from the syntax perspective, we apply Dependency Parsing to measure the Similarity of syntactic structure between adversarial and original texts, and the consistency of Dependency Parsing is evaluated by Unlabeled
Attachment Score (UAS) and Labeled Attachment Score (LAS). The dependency-based trees are parsed by Stanza (Qi et al., 2020). Furthermore, we also count the Overlap of perturbed tokens and syntactic heads, and study the dependency Relation9 between entities and their syntactic heads. We give examples for illustration in Figure 7 and 8. All statistics are shown in Table 5.
The results shown in Table 5 demonstrate the high similarity of syntactic structure between adversarial and original texts, which means that our method preserves the original dependency relations between different tokens well. Besides, more than 60% of Root tokens and around 50% syntactic heads of two entities are perturbed. Among all syntactic relations, nmod (nominal modifier), nsubj (nominal subject) and obl (oblique nominal) are Top-3 relations to the perturbed head.

heading: 4.4.3 Human Evaluation
text: We conduct a two-stage (STAGE 1 and STAGE 2) experiment on 2 datasets, and the screenshots of partial questionnaires are shown in Appendix C.
STAGE 1. We randomly sample 60 instances from both datasets which are successfully attacked by our method (“NV”) and others (“Gen”, “PWWS”, “TB”, “HF”). For each instance, we present adversarial examples generated by the five methods along with the original input to our volunteers, and ask them to rate generated samples in terms of grammaticality and fluency. Each sentence is scored on a scale of 0-5, while 0 is the worst and 5 is the best.
As shown in Table 6, “NV” gets an average score of 3.52 in STAGE 1, which is superior to that of other methods. Among the 60 adversarial examples generated by “NV”, 47 scored higher than or equal to 3 points. This result shows that adversarial
9https://universaldependencies.org/en/dep/ index.html
examples generated by our method have stable and good performance in terms of grammaticality and fluency, and they are more likely to be written by a human rather than a machine.
STAGE 2. We conduct relation-type annotation on the TACRED dataset, and randomly sample 120 instances that are successfully attacked by “NV”. For each adversarial example, we mark the head entity and tail entity, present the TRUE relation type along with 3 relevant relation types (extracted from the 40 relation types of TACRED) to our volunteers, and ask them to annotate the best match. Among the 120 adversarial examples, accounting for about 85.3% of samples are correctly annotated, which indicates “NV” is good at misleading the victim models while preserving human predictions.

heading: 4.4.4 Transferability
text: We use adversarial examples generated against different models to mislead each other, and the average attack performances of our method (“NV”) on 2 datasets are shown in Table 7.
As shown in Table 7, the adversarial examples generated against the “BertEntity” model possess stronger (achieve higher values of ASR) transferability, while those generated against the “PCNN” model possess more stable (the variance of ASR is approximately 0.21) transferability.

heading: 4.4.5 Adversarial Training
text: Adversarial Training (Goodfellow et al., 2015) is a method to confront adversarial attacks, and it uses adversarial examples to improve the robustness of target models. For further analysis, we generate another 5000 adversarial examples using our method (“NV”), and add them into original training sets to retrain (the settings of the training epoch are the same as that in Section 4.3.1) victim models. Figure 3 shows the classification performance of 3 victim models on adversarial sets (each adversarial set contains all of the adversarial examples generated by “NV” in Section 4.3.2).
With the gradual increase in the number of adversarial examples, the accuracy of victim models on adversarial sets shows an increasing trend (see
6 lines in Figure 3), and when the number reaches 4000, the classification accuracy of all models exceeds 65%. However, the process of Adversarial Training requires sufficient samples, and when the number of adversarial examples is 1000, the classification accuracy of all models lower than 65%. Thus, when the number of adversarial examples in the updated training set is relatively small, the robustness of DL models may not improve significantly.

heading: 5 Discussions
text: Despite our method can generate adversarial examples of high quality, there are still some limitations in this paper. In this section, we talk about the prominent advantage and significant limitations of our method.

heading: 5.1 Advantages
text: The prominent advantage of our method is Simplicity. We list the prerequisites and settings in different methods in Table 8.
As shown in Table 8, methods in Word-Level need fewer options to perturb targets in texts, and our method needs no extra requirements in the implementation. Furthermore, since we choose tokens labeled with the most important POS tags and treat them equally, there is no need to rank the importance of tokens.
Since textual adversarial attack task is a tradeoff between attack effectiveness, perception of grammar (Morphology, Syntax, Semantics) errors, complexity (of implementation), and so on, this simplicity brings the balanced development of our method on the above factors.

heading: 5.2 Limitations
text: The significant limitations of our method are Inferior ASR and Unknown Generalization.
Inferior ASR. Many reasons lead to this, such as no tokens can be substituted according to the principle of our method, or the predicted relation cannot be changed after all replacements, etc.
Unknown Generalization. The generalization of our method in different languages, tasks, etc. is unknown. Our work only considers the text in English, and it is mainly aimed at classification tasks.
Besides, although there will be losses on ASR, Semantic Similarity Checking (Jin et al., 2020) is still an essential method to retain original semantics, and help realize10 the real-world attacks mentioned in (Chen et al., 2022) (i.e., the confidence score conf is limited, and attackers can only access the victim models’ decisions). Moreover, to further reduce modifications on paragraphs or long documents, Root tokens and syntactic heads of two entities may have priority over other tokens to be substituted.

heading: 6 Conclusion
text: In this paper, a simple but effective method for generating adversarial examples and misleading relation classifiers is proposed. We first analyze the most important POSs from the perspective of linguistics. To reduce modification on original samples and avoid grammar mistakes, our method uses adjusted synonyms or hyponyms to substitute tokens labeled with the most important POS tags. Experimental results show the adversarial examples generated by our method have better quality (both evaluated by machines and humans). Furthermore, these samples possess promising transferability, and they are also helpful to improve the
10Attackers can greedily choose substitution words that are closest to the threshold of minimum semantic similarity between original and perturbed sentences.
robustness of victim models. We will further optimize our method and test it in other NLP tasks (e.g., sentiment analysis, textual entailment) in future work.

heading: Acknowledgements
text: We thank all volunteers for their efforts in human evaluation, and the anonymous reviewers for their valuable feedback.

heading: A Additional Implementation Details
text: We expand our work based on the DiagnoseAdv11 project. All comparison models and evaluation methods are implemented by using the interfaces provided by different modules (Attacker and Metric) in OpenAttack12. Besides, several tools (NLTK13, WordNet14, Pattern15, Stanza16) are used in the experiments. We keep all the default configurations given in OpenAttack and these tools.
All relation extraction models are built, trained, and tested through OpenNRE17. The max length of input sentences is set to 128, the batch size is set to 32, the learning rate is set to 2e-5, and we use the AdamW (Loshchilov and Hutter, 2019) optimizer. Besides, the value of dropout in the “PCNN” encoder is set to 0.5. The training (including initial and adversarial training) epoch of “Bert”, “BertEntity” and “PCNN” models are 20, 20, 200 respectively. In addition, the settings of other parameters in each module are kept default.

heading: B Complete Attack Performance
text: The complete attack performance of “PWWS”, “TB”, “Gen”, “HF” and our methods (including
11https://github.com/zxlzr/DiagnoseAdv 12https://github.com/thunlp/OpenAttack 13https://github.com/nltk/nltk 14https://github.com/nltk/nltk/tree/develop/
nltk/corpus 15https://github.com/clips/pattern 16https://github.com/stanfordnlp/stanza 17https://github.com/thunlp/OpenNRE
“NV”, “NVR”, “NVJ” and “NVJR”) against 3 victim models are shown in Table 9, 10 and 11.

heading: C Human Evaluation Details
text: Most of the volunteers are graduate students (some of them are Ph.D. candidates), and the statistics of their nationalities are shown in Figure 4. Figures 5 and 6 are questionnaires that the volunteers are invited to finish in different stages.
Before starting STAGE 1, we emphasize to volunteers that they should compare each generated text with the reference text, rather than comparing generated texts with each other.
Before starting STAGE 2, we include misclassified labels when designing the questionnaire. We count the top 10 misclassified labels (M10) by the victim model for each label, then randomly (to avoid duplication) select 3 wrong options from M10 for each question.

heading: D Case Study
text: The parsed dependency tree of an example is visualized by the interactive web-based demo18, and shown in Figure 7. We also give an example (see Figure 8) to introduce the Root word, syntactic heads of entities, and dependency relation in a sentence. Some adversarial examples generated by different methods are shown in Table 12 and 13.
18http://stanza.run/
ACL 2023 Responsible NLP Checklist

heading: A For every submission:

heading: 3 A1. Did you describe the limitations of your work?
text: Section 5.2

heading: 3 A2. Did you discuss any potential risks of your work?
text: Section 1, Section 4.4.4, Section 4.4.5

heading: 3 A3. Do the abstract and introduction summarize the paper’s main claims?
text: Abstract, Section 1
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 3 Did you use or create scientific artifacts? Section 4.1, Section A in the supplemental material, Section 3.2

heading: 3 B1. Did you cite the creators of artifacts you used?
text: Section 4.1, Section A in the supplemental material, Section 3.2
7 B2. Did you discuss the license or terms for use and / or distribution of any artifacts? All public datasets used in this paper were either open-sourced or released by the original authors, and we were unable to find the license for the dataset we used.
7 B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? The intended use of two datasets is to benchmark relation extraction models, and train knowledge base population systems. We study the adversarial attack in the relation classification scenario, thus it is consistent with their original use in this paper.
7 B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? Neither of the authors of the two datasets discusses this in their work, and we do not consider it independently.

heading: 3 B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and
text: linguistic phenomena, demographic groups represented, etc.? Section 4.1
3 B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. Section 4.1
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.
C 7 Did you run computational experiments? Left blank.
C1. Did you report the number of parameters in the models used, the total computational budget (e.g., GPU hours), and computing infrastructure used? No response.
C2. Did you discuss the experimental setup, including hyperparameter search and best-found hyperparameter values? No response.
C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? No response.
C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? No response.
D 3 Did you use human annotators (e.g., crowdworkers) or research with human participants? Section 4.4.3, Section C in the supplemental material
7 D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? We just warned the participants that there might be improper content (misunderstanding due to cultural differences) orally, and we didn’t make an instruction file given to volunteers independently.
7 D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? Most of the volunteers are international students, and we teach them Chinese as a kind of "payment”.
7 D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? We informed volunteers that their human evaluation results will be collected and analyzed only for scientific paper writing.
7 D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? We have no data to collect, and we analyze the results only based on the annotation in questionnaires.
7 D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? We gave the nationality information of volunteers in Section C in the supplemental material.

heading: Future Work
text: , sentiment analysis, textual entailment) in future work