NatLogAttack: A Framework for Attacking Natural Language Inference Models with Natural Logic
Year: 2023

Abstract:
Reasoning has been a central topic in artificial intelligence from the beginning. The recent progress made on distributed representation and neural networks continues to improve the state-of-the-art performance of natural language inference. However, it remains an open question whether the models perform real reasoning to reach their conclusions or rely on spurious correlations. Adversarial attacks have proven to be an important tool to help evaluate the Achilles’ heel of the victim models. In this study, we explore the fundamental problem of developing attack models based on logic formalism. We propose NatLogAttack to perform systematic attacks centring around natural logic, a classical logic formalism that is traceable back to Aristotle’s syllogism and has been closely developed for natural language inference. The proposed framework renders both label-preserving and label-flipping attacks. We show that compared to the existing attack models, NatLogAttack generates better adversarial examples with fewer visits to the victim models. The victim models are found to be more vulnerable under the label-flipping setting. NatLogAttack provides a tool to probe the existing and future NLI models’ capacity from a key viewpoint and we hope more logicbased attacks will be further explored for understanding the desired property of reasoning. 1

heading: 1 Introduction
text: While deep neural networks have achieved the stateof-the-art performance on a wide range of tasks, the models are often vulnerable and easily deceived by imposing perturbations to the original input (Goodfellow et al., 2014; Kurakin et al., 2018), which seriously hurts the accountability of the systems. In depth, this pertains to model robustness, capacity, and the development of models with more advanced intelligence.
1The code of NatLogAttack is available at https:// github.com/orianna-zzo/NatLogAttack.
Natural language inference (NLI), also known as textual entailment (Dagan et al., 2005; Iftene and Balahur-Dobrescu, 2007; MacCartney, 2009; Bowman et al., 2015), is a fundamental problem that models the inferential relationships between a premise and hypothesis sentence. The models built on distributed representation have significantly improved the performance on different benchmarks (Bowman et al., 2015; Chen et al., 2017; Williams et al., 2018; Chen et al., 2018; Devlin et al., 2019; Liu et al., 2019; Zhang et al., 2020; Pilault et al., 2021). However, it is still highly desirable to conduct research to probe if the models possess the desired reasoning ability rather than rely on spurious correlation to reach their conclusions (Glockner et al., 2018; Poliak et al., 2018; Belinkov et al., 2019; McCoy et al., 2019; Richardson et al., 2020).
Adversarial attacks have proven to be an important tool to reveal the Achilles’ heel of victim models. Specifically for natural language inference, the logic relations are easily broken if an attack model does not properly generate the adversarial examples following the logic relations and related semantics. Therefore, unlike other textual attack tasks such as those relying on semantic similarity and relatedness, it is more challenging to create effective attacks here.
In this study, we explore the basic problem of developing adversarial attacks based on logic formalism, with the aim to probe victim models for the desired reasoning capability. Specifically, we propose NatLogAttack, in which the adversarial attacks are generated based on natural logic (Lakoff, 1970; Van Benthem, 1995; MacCartney, 2009; Icard, 2012; Angeli et al., 2016; Hu and Moss, 2018; Chen et al., 2021), a classical logic formalism with a long history that has been closely developed with natural language inference. From a general perspective, natural language inference provides an appropriate setup for probing the development of distributed representation and the
9960
models based on that. A robust solution for the task requires manipulation of discrete operations and adversarial attacks can help understand whether and how the required symbols and inference steps emerge from the data and the learned distributed representation. Our work has also been inspired by recent research on exploring the complementary strengths of neural networks and symbolic models (Garcez et al., 2015; Yang et al., 2017; Rocktäschel and Riedel, 2017; Evans and Grefenstette, 2018; Weber et al., 2019; De Raedt et al., 2019; Mao et al., 2019; Feng et al., 2020, 2022).
Our research contributes to the development of logic-based adversarial attacks for natural language understanding. Specifically, we propose a novel attack framework, NatLogAttack, based on natural logic for natural language inference. Our experiments with both human and automatic evaluation show that the proposed model outperforms the state-of-the-art attack methods. Compared to the existing attack models, NatLogAttack generates better adversarial examples with fewer visits to the victim models. In addition to the commonly used attack setting where the labels of generated examples remain the same as the original pairs, we also propose to construct label-flipping attacks. The victim models are found to be more vulnerable in this setup and NatLogAttack succeeds in deceiving them with much smaller numbers of queries. NatLogAttack provides a systematic approach to probing the existing and future NLI models’ capacity from a basic viewpoint that has a traceable history, by combining it with the recent development of attacking models. The proposed framework is constrained by the natural logic formalism and we hope more logic-based attacks will be further explored for understanding the desired property of natural language reasoning.

heading: 2 Related Work
text: Adversarial Attacks in NLP. White-box attacks leverage the architecture and parameters of victim models to craft adversarial examples (Liang et al., 2018; Wallace et al., 2019; Ebrahimi et al., 2018). Black-box models, however, have no such knowledge. Pioneering blind models (Jia and Liang, 2017), for example, create adversarial examples by adding distracting sentences to the input. More recently, score-based (e.g., Zhang et al. (2019); Jin et al. (2020)) and decision-based attack models (Zhao et al., 2018) also query the prediction
scores or the final decisions of victim models. In terms of perturbation granularities, characterlevel attacks modify characters (Ebrahimi et al., 2018) while word-level models rely on word substitutions that can be performed based on word embeddings (Sato et al., 2018), language models (Zhang et al., 2019), or even external knowledge bases (Zang et al., 2020). Sentence-level attack models add perturbation to an entire sentence by performing paraphrasing (Iyyer et al., 2018) or attaching distracting sentences (Jia and Liang, 2017).
Kang et al. (2018) generated natural language inference examples based on entailment label composition functions with the help of lexical knowledge. Minervini and Riedel (2018) utilized a set of first-order-logic constraints to measure the degree of rule violation for natural language inference. The efforts utilized the generated examples for data augmentation. The focus is not on adversarial attack and the adversarial examples’ quality, e.g., the attack validity, is not evaluated.
Natural Logic. Natural logic has a long history and has been closely developed with natural language inference (Lakoff, 1970; Van Benthem, 1995; MacCartney, 2009; Icard, 2012; Angeli et al., 2016; Hu and Moss, 2018; Chen et al., 2021). Recently, some efforts have started to consider monotonicity in attacks, including creating test sets to understand NLI models’ behaviour (Richardson et al., 2020; Yanaka et al., 2019a,b, 2020; Geiger et al., 2020). The existing work, however, has not performed systematic attacks based on natural logic. The core idea of monotonicity (e.g., downward monotone) and projection has not been systematically considered. The models have not been combined with the state-of-the-art adversarial attack framework and search strategies for the general purpose of adversarial attacks. For example, Richardson et al. (2020) and Yanaka et al. (2020) generate adversarial examples from a small vocabulary and pre-designed sentence structures. The effort of Yanaka et al. (2019b) is limited by only considering one-edit distance between a premise and hypothesis. We aim to explore principled approaches to constructing perturbations based on natural logic, and the control of the quality of attack generation can leverage the continuing advancement of language models. The proposed attack settings, along with the breakdown of attack categories, help reveal the properties of victim models in both label-preserving and label-flipping attacks.
3 NatLogAttack: A Natural-logic-based Attack Framework
This section introduces NatLogAttack, a systematic adversarial attack framework centring around natural logic. The overview of NatLogAttack’s generation and attack process is depicted in Figure 1. Below we will introduce the background, attack principles, setups, and each component of the framework.

heading: 3.1 Background
text: The study of natural logic can be traced back to Aristotle’s syllogisms. Rather than performing deduction over an abstract logical form, natural logic models inference in natural language by operating on the structure or surface form of language (Lakoff, 1970; van Benthem, 1988; Valencia, 1991; Van Benthem, 1995; Nairn et al., 2006; MacCartney, 2009; MacCartney and Manning, 2009; Icard, 2012; Angeli and Manning, 2014; Hu and Moss, 2018; Chen and Gao, 2021; Chen et al., 2021). It allows for a wide range of intuitive inferences in a conceptually clean way that we use daily and provides a good framework for attacking inference models—we doubt that a victim model vulnerable to such natural attacks indeed performs reliable reasoning. Our work uses the natural logic variant proposed by MacCartney and Manning (2009) and MacCartney (2009), which extends the prior formalism to model the entailment relations between two spans of texts with seven relations B = {≡,⊏,⊐,∧, | ,⌣,# }, representing equivalence, forward entailment, reverse entailment, negation, alternation, cover, and independence, respectively. Through projection based on monotonicity in context, local lexical-level entailment relations between a premise and hypothesis can be aggregated to determine the entailment relations at the sentence-pair level. For completeness of this paper, we highlight the key building blocks in Appendix A.
3.2 NatLogAttack Setups and Principles
Formally, given a premise sentence P , its nword hypothesis H = (h1, h2, · · · , hn), and the ground-truth natural language inference label yg = L(P,H), NatLogAttack generates a hypothesis H∗ that satisfies a desired target label y∗g = L(P,H∗). The attacking pair ⟨P,H∗⟩ is generated only if the original pair ⟨P,H⟩ is correctly classified by a victim model F. Accordingly, we denote y = F(P,H) as the natural language inference label predicated by the victim model F for the original pair and denote y∗ = F(P,H∗) as the predicted label for the attacking pair.
We propose to perform the attacks in two setups: the label-preserving and label-flipping attacks. The attack principles and setups are summarized in Table 1. A label-preserving attack generates adversarial examples with y∗g = yg, aiming to test the robustness of victim models on different inputs that have the same label—it attacks victim models under perturbations that do not change the inferential labels of the original premise-hypothesis pair.
The label-flipping attacks, on the other hand, aim at attacking victim models with perturbations that are key to differentiating two different logical relations where y∗g ̸= yg. Note that natural logic can be naturally used to generate label-flipping attacks, and our work here is among the first to explore this type of attacks for natural language understanding, although label-flipping attacks have been explored in image attacks (Tramèr et al., 2020).
The third column of the table (strategy) lists the logic conditions between the generated hypothesis H∗ and the original hypothesis H that satisfy the desired properties of preserving or flipping labels to obtain the target label y∗g . Consider the second row of the label-preserving setup (i.e., C → C), in which NatLogAttack generates a hypothesis H∗ with y∗g = yg = contradiction. This is achieved by ensuring the natural language inference label between H∗ and H to obey entailment: H∗ ⊨ H . 2 This guarantees the sentence pair ⟨P,H∗⟩ to have a contradiction relation. In the natural logic formalism (MacCartney, 2009), this is implemented with H ≡ H∗ or H ⊐ H∗. Consider another example. In the last row of the label-flipping setup, NatLogAttack generates a new hypothesis H∗ with y∗g = entailment from a contradiction pair, implemented by following the natural logic relations H ≡ ¬H∗ or H ⊐ ¬H∗. Constraint 3.1 We constrain NatLogAttack from generating neutral attack examples (y∗g= neutral) using the premise-hypothesis pairs with yg=contradiction, because two contradictory sentences may refer to irrelevant events from which a neutral pair cannot be reliably generated. 3
Constraint 3.2 NatLogAttack is also constrained from generating contradiction and entailment attacks (y∗g= contradiction or y∗g= entailment) from neutral pairs (yg=neutral), as there are many ways two sentences being neutral, including reverse entailment and diverse semantic relations. The contradiction and entailment pairs cannot be reliably generated.

heading: 3.3 Generation and Quality Control

heading: 3.3.1 Preparing Natural Logic Relations
text: As shown in the bottom-left part of Figure 1, given a premise-hypothesis pair ⟨P,H⟩, the ground-truth label yg, and the target label y∗g , NatLogAttack retrieves natural logic relations from the last column of Table 1. Consider label-preserving attacks and take y∗g = yg =entailment as an example. From the last column in the first row of the label-preserving setup, NatLogAttack finds and pushes the relations ≡ and ⊏ into the natural-logic relations set, R∗g = {≡,⊏}, where R∗g includes the natural-logic
2We use the entailment notation that is same as in (MacCartney and Manning, 2009).
3For example, The SNLI (Bowman et al., 2015) and MNLI datasets (Williams et al., 2018) were annotated under a guideline with a specific assumption of treating potentially irrelevant events as contraction.
relations between H and H∗ and will be used to generate the latter. Note that r∗g ∈ R∗g is one of relations in R∗g.
We first copy H to H(1), denoted as H(1) ← H for the convenience of notation, because the generation-and-attack process may be performed multiple rounds if one round of attacks fail. Then we use the notation H(1) and H(2) to refer to the original and a generated hypothesis sentence in each round. Note that in the above example, as will be discussed below, within each round of generation, NatLogAttack will provide a set of attacks to perform multiple (iterative) attacks.

heading: 3.3.2 Candidate Generation
text: Algorithm 1: Candidate Generation Input: Sentence H(1) with tokens (h(1)1 , · · · , h(1)n ),
target natural-logic relation set R∗g Output: Candidate sentence set H
1 Init H = ∅ 2 L = natlog(H(1))
3 foreach h(1)i ∈H(1) and r∗g ∈ R∗g do 4 R∗local = LB[idx
Li(r∗g)] 5 if ≡ ∈ R∗local then 6 H = H ∪ PerturbSyno(H(1), h(1)i ) 7 H = H ∪ DoubleNegation(H(1)) 8 end 9 if ⊏ ∈ R∗local then
10 H = H ∪ PerturbHyper(H(1), h(1)i ) 11 H = H ∪ Deletion(H(1), i) 12 end 13 if ⊐ ∈ R∗local then 14 H = H ∪ PerturbHypo(H(1), h(1)i ) 15 H = H ∪ Insertion(H(1), i) 16 end 17 if | ∈ R∗local then 18 H = H ∪ PerturbCoHyper(H(1), h(1)i ) 19 H = H ∪ PerturbAnto(H(1), h(1)i ) 20 H = H ∪ AltLM(H(1), i) 21 end 22 if ∧ ∈ R∗local then 23 H = H ∪ AddNeg(H(1), h(1)i ) 24 end 25 end
Return: H
Our candidate attack generation process is described in Algorithm 1. Taking H(1) and R∗g as the input, the algorithm aims to generate a set of candidate hypotheses H = {H(2)1 , · · · , H (2) m } with each pair ⟨H(1), H(2)i ⟩ following a target relation r∗g ∈ R∗g where H(2)i ∈ H. For each token h(1)i ∈ H(1) and r∗g ∈ R∗g, the algorithm obtains the monotonicity and relation projection infor-
mation using the Stanford natlog parser4 (line 2). Specifically for h(1)i , suppose the parser outputs an ordered relation list: Li = ⟨≡,⊐,⊏,∧, | ,⌣,#⟩, this returned list actually encodes the contextualized projection information, which we leverage to substitute h(1)i with h ′ i to generate H (2) i that satisfies relation r∗g . In natural logic, when determining the sentencelevel logical relation between a premise and hypothesis sentence, projection is used to map local lexicon-level logical relation to sentence-level relations by considering the context and monotonicity. However, in adversarial attacks, NatLogAttack needs to take the following reverse action:
Rlocal = LB[idx Li(r∗g)] (1)
where r∗g is the target sentence-level natural logic relation (in our above example, suppose r∗g=‘⊏’). Then idxLi(.) returns the index of that relation in Li. For ‘⊏’, the index is 3. Then the index is used to find the lexicon-level (local) relation from the predefined ordered list LB = ⟨≡,⊏,⊐,∧, | ,⌣, # ⟩. In the above example we will get LB[3]=‘⊐’. Again, Equation 1 presents a reverse process of the regular projection process in natural logic. In other words, the ordered relation list provided by the natlog parser for each word token, when used together with the predefined (ordered) relation list LB, specifies a mapping between global (sentence-level) natural-logic relations and local (lexicon-level) relations. Note also that the output Rlocal is a set, because Li is an ordered list that may contain the same relation multiple times.
Basic Word Perturbation. For a word token hi, we replace it with word h′i to ensure the local relation ⟨hi, h′i⟩ to be rlocal ∈ Rlocal. NatLogAttack extracts natural-logic relation knowledge from knowledge bases to obtain word candidates for the desired relation types. The word perturbation of NatLogAttack focused on five relations in Table 8.
Constraint 3.3 Since cover (⌣) is very rare and independence (#) is ambiguous, NatLogAttack is constrained to only focus on utilizing the remaining five relations: {≡,⊏,⊐,∧, |}.
We attack the victim models using the most basic semantic relations explicitly expressed in knowledge bases and knowledge implicitly embedded in large pretrained language models. Specifically, we
4https://stanfordnlp.github.io/CoreNLP/natlog.html.
use WordNet (Miller, 1995) to extract the desired lexical relations. For a word token hi, we search candidate words h′i that has one of the following relations with hi: {≡, ⊏,⊐,∧, |}. Synonyms are used as h′i to substitute hi for constructing H (2) with an equivalence relation to H(1) (line 6), hypernyms are used for forward entailment (line 10), and hyponyms for reverse entailment (line 14). Due to the transitiveness of forward entailment (⊏) and reverse entailment (⊐), we centre around hi to find its hypernyms and hyponyms but restrict the distances within a threshold to avoid generating sentences that are semantically unnatural, contain overgeneralized concepts, or are semantically implausible. Later, we will further use a language model to control the quality.
For alternation, the perturbation candidates h′i are words that share the common hypernym with hi (line 18). Following MacCartney (2009), we do not use antonyms of content words for the negation relation but instead use them to construct alternation hypotheses (line 19). For the negation (line 23), a list of negation words and phrases is used to construct new hypotheses. Note that while our experiments show the NatLogAttack has been very effective and outperforms other attack models, some of the components can be further augmented as future work.
Enhancing Alternation. As discussed above, attacks may run multi-rounds if the prior round fails. For alternation substitution, NatLogAttack does not replace the word token that has been substituted before, since the alternation of alternation does not guarantee to be the alternation relation. In addition to constructing alternation hypotheses using WordNet, we further leverage DistilBert (Sanh et al., 2019) to obtain the alternation candidates using the function AltLM (line 20). Specifically, we mask the target word (which is a verb, noun, adjective or adverb) and prompt the language model to provide candidates. The provided candidates and replaced words are required to have the same POS tags.
Insertion and Deletion. In addition to substitution, NatLogAttack also follows natural logic and
monotonicity to construct examples using the insertion and deletion operations. As shown in Table 2, adjectives, adverbs and prepositional phrases are leveraged in the upward and downward context of monotonicity to enhance the attacks for entailment (‘⊏’) and reverse entailment (‘⊐’). We include the details in Appendix B, which is built on Stanford CoreNLP parser and pretrained language models. Note that the syntactic rules do not guarantee to generate sentences with the desired NLI labels (e.g., see (Partee, 1995) for the discussion on the semantic composition of adjective + noun) and the process is only for generating candidates. We will use the pretrained language model to further identify good adversarial examples at a later stage. Both the insertion and deletion operations are used with monotonicity and projection context to generate different relations.

heading: 3.3.3 Attack Quality Control
text: NatLogAttack uses DistilBert (Sanh et al., 2019) to calculate the pseudo-perplexity scores (Salazar et al., 2020) for all generated hypotheses H = {H(2)1 , H (2) 2 , · · · , H (2) m }, and keeps only a maximum of 100 candidates with the lowest perplexity values. In our development, we found that the quality control stage is important for ensuring the quality of attack examples, particularly for reducing word perturbation mistakes resulting from incorrect interpretation of the words being substituted, which often results in unnatural hypothesis sentences, as well as reducing other sources of low-quality attacks including over-generalization of concepts and implausible semantics caused by insertion and deletion. The output of this stage is an ordered list of candidate attacksHsqc = ⟨H(2)r1 , H(2)r2 , · · · , H(2)rk ⟩.

heading: 3.4 Iterative and Multi-rounds Attacking
text: As discussed above, NatLogAttack performs iterative attacking within each round of generation and then multi-round attacks if the current round fails. Within each round, the original premise P and each hypothesis in the ranked hypotheses listHsqc form an attack list ⟨⟨P,H(2)r1 ⟩, · · · , ⟨P,H(2)rk ⟩⟩. As shown in Figure 1, when an attack succeeds, we output the corresponding hypothesis as H∗, which is sent for evaluation. If an attack fails, the next pair in the ranked attack list will be tried until the list is exhausted. Then NatLogAttack organizes the next round of attacks. In total NatLogAttack generates a maximum of 500 attacks for each ⟨P,H⟩ pair.
When generating the next round attacks, we identify the adversarial pair for which the victim model has the lowest confidence (indexed as jlc) over the ground-truth class y∗g :
jlc = argmin j∈{r1,...,rk}
{sr1 , . . . , srk} (2)
srj = o(y ∗ g |(P,H(2)rj )) (3)
where o(∗) returns the corresponding softmax probabilities of the output layer. We then copy H(2)jlc to H(1), denoted as H(1) ← H(2)jlc . The attack continues until the victim model is deceived to make a wrong prediction y∗ that is different from the ground truth y∗g or the maximum number of attacks is reached.

heading: 4 Experiments and Results

heading: 4.1 Experimental Setup
text: Dataset Our study uses SNLI (Bowman et al., 2015), MNLI (Williams et al., 2018), MED (Yanaka et al., 2019a), HELP (Yanaka et al., 2019b), and SICK (Marelli et al., 2014; Hu et al., 2020) datasets. The MED upward and downward subsets are denoted as MEDup and MEDdown, respectively. Details of the datasets and the setup for training can be found in Appendix C.
Attack and Victim Models We compared the proposed model to five representative attack models including the recent state-of-the-art models: Clare (Li et al., 2021), BertAttack (Li et al., 2020), PWWS (Ren et al., 2019), TextFooler (Jin et al., 2020) and PSO (Zang et al., 2020). Specifically, we used the implementation made publicly available in TextAttack.5 For victim models, we used uncased BERT (Devlin et al., 2019) and RoBERTa base models (Liu et al., 2019). The accuracy of victim models is included in Table 3, which is comparable to the state-of-the-art performance.
Evaluation Metrics Three metrics are used to evaluate the models from different perspectives. The sign ↑ (↓) indicates that the higher (lower) the values are, the better the performance is.
5https://github.com/QData/TextAttack
• Human Validated Attack Success Rate (HVASR ↑). Most existing attacking methods are evaluated with attack success rates that are not validated by human subjects, assuming that the attacking methods could generate adversarial examples of the desired labels. This assumption works for many NLP tasks such as sentiment analysis and text classification. However, this is not the case in NLI, since the logical relationships can be easily broken during the generation process. As observed in our experiments, although the state-of-art attacking models (BertAttack and Clare) attain high attack success rates on various NLP tasks, human-validated evaluation demonstrates that they are much less effective in attacking natural language reasoning. To reliably evaluate the attack performance, we use Human Validated Attack Success Rate (HVASR). Specifically, we used Amazon Mechanical Turk6
to validate if the generated attack examples belong to the desired relations. Each example was annotated by at least three workers and the label is determined by the majority voting. HVASR is the percentage of successful-and-valid adversarial examples that successfully deceived the victim models to make the wrong prediction and at the same time the majority of the annotators think their NLI labels are the desired target labels y∗g . While HVASR is our major evaluation metric, we also use query numbers and perplexity to provide additional perspectives for observations. • Query number (QN ↓) refers to the average number of times that a successful attack needs to query the victim model (Zang et al., 2020; Li et al., 2020). QN can reflect the efficiency (but
6https://www.mturk.com/
not effectiveness) of an attack model. • Perplexity (PPL ↓) reflects the fluency and qual-
ity of generated examples. Same as in (Zang et al., 2020; Li et al., 2021), it is computed with GPT-2 (Radford et al., 2019) during evaluation.

heading: 4.2 Results and Analysis
text: Results on Label Preserving Attacks Table 4 shows the performance of different models on labelpreserving attacks. We can see that NatLogAttack consistently achieves the best performance on HVASR. The detailed results on MED also show that NatLogAttack has a better ability to construct adversarial examples in both upward and downward monotone. NatLogAttack also shows superior performance on average QN and PPL in nearly all setups.
We can see that NatLogAttack has a large HVASR and small QN value in MEDup, suggesting that NatLogAttack can easily generate attacks in the upward monotone. However, in MEDdown, NatLogAttack needs more efforts (QN). Our further analysis reveals that this is because in the downward monotone, the attack model relies more on the insertion operation than deletion, and the former is more likely to result in unsuccessful attempts.
Figure 2 further compares the query numbers (QNs) of different attack models on BERT and RoBERTa in terms of the medians (instead of means) and density of QN. We can see that the majority of query numbers of NatLogAttack are rather small and medians are less than 12 for on both SNLI and MED, showing that NatLogAttack could attack successfully with very limited attempts in most cases. For each attack model, the density of QN on
BERT and RoBERTa is close to each other and the medians are indiscernible and are represented by the same red dot in the figure.
Results on Label Flipping Attacks Table 5 shows the performance of NatLogAttack on the label-flipping attacks. Note that there has been little prior work providing systematic label-flipping attacks for NLP tasks. This new angle of evaluation is more easily implemented with logic-based attacks and provides additional insights. Specifically, the table shows that the numbers of queries that NatLogAttack sent to the victim models are much smaller than those in the label-preserving setting presented in Table 4, suggesting that the victim models are more vulnerable in label-flipping setting. For example, we can see that most of the query numbers are within 1-5 in Table 5. The pretrained victim models are capable of memorizing the superficial features related to the original label and have difficulty in capturing the logical relationship when we alter them between sentences by keeping the majority of words untouched.
In both the label-preserving and label-flipping setup, the HVASR may still be further improved, although the proposed models have substantially outperformed the off-the-shelf state-of-the-art attack models and cautions have been exercised in all attack generation steps, which leaves room for
more research on improving logic-based attacks as future work.
Examples and Analysis. Table 6 provides the generated attack examples in the label-preserving setup (E → E), in which we can see the quality of attacks generated by NatLogAttack is clearly higher. The baseline attacking models generate adversarial examples by replacing words based on word embedding or language models, which can easily break the logic relationships. Some examples in Table 6 show that the baselines often rely on semantic relatedness to construct adversarial examples, which is not detailed enough for NLI and hence break the logic relations (e.g., the last BertAttack example). Also, the last example of Clare shows that the model deletes words without considering the context (downward) monotonicity, resulting in an invalid attack. Note that the baseline models modify both premises and hypotheses and NatLagAttack focuses only on modifying hypotheses—it is straightforward to copy or adapt the operations of NatLagAttack to modify premises—in many applications, it is more natural to modify the hypotheses and keep the premises (evidences) untouched.
Table 7 shows more adversarial examples generated by NatLogAttack in the label-flipping setup. For all the six examples, the prediction of the victim model RoBERTa remains unchanged (i.e., entailment, entailment and contradiction for the first, middle, and last two examples, respectively), while the ground-truth labels are now contradiction, neutral, and entailment, respectively. The victim model had difficulty in telling the difference, which renders an angle to challenge the models’ ability of understanding and perform reasoning.

heading: 5 Conclusion
text: Towards developing logic-based attack models, we introduce a framework NatLogAttack, which centres around the classical natural logic formalism. The experiments with human and automatic evaluation show that the proposed framework outperforms the existing attack methods. Compared to these models, NatLogAttack generates better adversarial examples with fewer visits to the victim models. In addition to the widely used labelpreserving attacks, NatLogAttack also provides label-flipping attacks. The victim models are found to be more vulnerable in this setup and NatLogAttack succeeds in deceiving them with
much smaller numbers of queries. NatLogAttack provides an approach to probing the existing and future NLI models’ capacity from a key viewpoint and we hope more logic-based attacks will be further explored for understanding the desired property of reasoning.
Limitations
Our research focuses on the adversarial attack itself and provides a framework that can be potentially used in different adversarial training strategies. We limit ourselves on attacks in this work, but it would be interesting to investigate logic-based attacks in adversarial training. We will leave that as future work. The proposed attack approach is also limited by the limitations of natural logic, while the latter has been a classical logic mechanism. For example, our proposed framework has less deductive power than first-order logic. It cannot construct
attacks building on inference rules like modus ponens, modus tollens, and disjunction elimination. As discussed in the paper, some components of the generation and quality control process can be further enhanced.

heading: Acknowledgements
text: The research is supported by the NSERC Discovery Grants and the Discovery Accelerator Supplements. We thank Bairu Hou for his contributions to an early version of the proposed model.

heading: A Background
text: Our work is based on the specific natural logic formalism proposed by MacCartney and Manning (2009) and MacCartney (2009). To model the entailment relations between two spans of texts, MacCartney and Manning (2009) introduced seven relations inspired by the set theory: B = {≡,⊏,⊐ ,∧, | ,⌣,# } (see Table 8 for some examples). The inference of natural logic is built on monotonicity, which is a pervasive feature of natural language that explains the impact of semantic composition on entailment relations (Van Benthem et al., 1986; Valencia, 1991; Icard and Moss, 2014). Suppose dog ⊏ animal, the upward monotone context keeps the entailment relation when the argument “increases”
(e.g., dog ⊏ animal). Downward monotone keeps the entailment relation when the argument “decreases” (e.g., in all animals ⊏ all dogs). The system performs monotonicity inference through a projection ρ : B→ B, which is determined by the context and projection rules. As will be detailed, a monotonicity-based parser can provide monotonicity information for each word token in a sentence and the projection information. For example, consider the sentence All↑ the↓ kids↓ run↑, where ↑ denoted upward polarity and ↓ downward polarity. If we mutate the word kids with boys, where kids ⊐ boys, the system projects the reverse entailment (‘⊐’) into forward entailment (‘⊏’) due to its downward polarity, i.e., ρ (‘⊐’) = ‘⊏’, and thus All the kids run ⊏ All the boys run.
With these components ready, the system aggregates the projected local relations to obtain the inferential relation between a premise and hypothesis sentence. Specifically, Table 9 (MacCartney, 2009; MacCartney and Manning, 2009; Angeli and Manning, 2014) shows the composition function when a relation in the first column is joined with a relation listed in the first row, yielding the relations in the corresponding table cell. MacCartney (2009) shows that different orders of compositions yield consistent results except in some rare artificial cases. Therefore, many works, including ours, perform a sequential (left-to-right) composition. Consider two edits from the premise sentence, All the kids run, to the hypothesis, All the boys sleep. The first edit that replaces kids in the premise with boys yields All the kids run ⊏ All the boys run. The second edit of replacing run with sleep yields All the boys run | All the boys sleep. Based on Table 9, the union of the relations resulted from these two edits (i.e., ‘⊏’ 1 ‘|’) is ‘ | ’, where 1 is the union operator. As a result, we obtain All the kids run | All the boys sleep.
The seven natural logic relations at the sentencepair level can then be mapped to the typical threeway NLI labels (entailment, contradiction, and neutral), where the ‘≡ ’ or ‘⊏ ’ relation can be mapped to entailment; the ‘∧ ’ or ‘ | ’ relation to contradiction; the ‘⊐ ’, ‘⌣ ’, and ‘# ’ to neutral.
B Insertion and Deletion
For both insertion and deletion, the part-ofspeech (POS) tags and constituency parse tree for H(1) are first obtained using Stanford CoreNLP
parser7, which are then used with a state-of-the-art pretrained model to perform insertion. To insert an adjective before a noun or an adverb after a verb, NatLogAttack leverages DistilBert (Sanh et al., 2019) to obtain the candidates in the corresponding locations. The syntactic rules do not guarantee to generate sentences with the desired NLI labels (e.g., see (Partee, 1995) for discussion on the semantic composition of adjective + noun). The above process is only for generating candidates, and we will use pretrained language models to find good adversarial examples.
In order to insert a prepositional phrase (PP), we first collected from the SNLI training dataset all the PPs that are the constitutes of other noun phrases (NPs) for more than 100 times. We also collected PPs that appear in other verb phrases (VPs) at least 100 times. During insertion, these PPs will be added as modifiers to a noun or a verb, respectively. We also insert assertion phrases such as "It is not true that" to deceive the victim models. For the deletion operation, we delete the corresponding constituents based on the parse tree and POS tags.

heading: C Details of Datasets and Baselines
text: As discussed in Section 4.1, our study uses SNLI (Bowman et al., 2015), MNLI (Williams et al., 2018), MED (Yanaka et al., 2019a), HELP (Yanaka et al., 2019b), and SICK (Marelli et al., 2014; Hu et al., 2020) to evaluate the models. SNLI and MNLI are widely-used general-purpose NLI datasets. Following Li et al. (2021), for MNLI, we evaluate the performance on the matched set. MED and HELP are designed for monotonicitybased reasoning and hence suit for probing models’ capacity in natural logic-related behaviour. SICK is rich in lexical, syntactic and semantic phenomena designed for distributional semantic models including those recognizing textual entailment. For SICK,
7https://stanfordnlp.github.io
we use the corrected labels proposed by Hu et al. (2020). The pretrained victim models tested on the SNLI, MNLI, and SICK test set were finetuned on their own training set and the performances are comparable to the state-of-the-art performances as well as those used in the previous attack models. Following Yanaka et al. (2019a), the models tested on MED are finetuned on both the SNLI training set and the entire HELP dataset. Since HELP is not manually annotated, we do not use it as the test set. The MED upward subset is denoted as MEDup and downward subset as MEDdown. Following (Alzantot et al., 2018; Zang et al., 2020), each test set has 1,000 sentence pairs. Also following Zeng et al. (2021), we set the maximum query number to be 500.
For all the attack models in comparison, we used the implementation made available by Morris et al. (2020). Details of these attack models are as follows.
• PWWS (Ren et al., 2019) makes use of the synonyms in WordNet (Miller, 1995) for word substitutions and designs a greedy search algorithm based on the probability-weighted word saliency to generate adversarial samples.
• TextFooler (Jin et al., 2020) utilizes counterfitting word embeddings to obtain synonyms and then performs substitution based on that.
• PSO (Zang et al., 2020) utilizes the knowledge base HowNet (Dong et al., 2010) to generate word substitutions. It adopts particle swarm optimization, another popular metaheuristic population-based search algorithm, as its search strategy.
• BertAttack (Li et al., 2020) leverages the superior performance of pretrained language model and greedily replaces tokens with the predictions from BERT.
• Clare (Li et al., 2021) adds two more types of perturbations, insert and merge, building on BertAttack. Since Clare has a very high query number to the victim models, we reduce the number of each type of perturbation to 10 in order to make sure that Clare can attack the victim model successfully within the maximum query number in most cases.
ACL 2023 Responsible NLP Checklist

heading: A For every submission:

heading: 3 A1. Did you describe the limitations of your work?
text: They are in the Limitation Section
7 A2. Did you discuss any potential risks of your work? We do not envision there are potential risks.

heading: 3 A3. Do the abstract and introduction summarize the paper’s main claims?
text: The abstract and introduction summarize the main claims presented in section 3-5.
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 3 Did you use or create scientific artifacts? Section 3 and 4.

heading: 3 B1. Did you cite the creators of artifacts you used?
text: Section 3 an 4
7 B2. Did you discuss the license or terms for use and / or distribution of any artifacts? We used the mostly widely use NLP tools.
7 B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? Not relevant.
7 B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? we do not think the data we used contain such information.
7 B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? not relevant
3 B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. Left blank.
C 3 Did you run computational experiments? section 4
7 C1. Did you report the number of parameters in the models used, the total computational budget (e.g., GPU hours), and computing infrastructure used? we did not collect the information.
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.

heading: 3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found
text: hyperparameter values? section 4

heading: 3 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary
text: statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? Section 4: we report statistical significance test.

heading: 3 C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did
text: you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? section 4
D 3 Did you use human annotators (e.g., crowdworkers) or research with human participants? section 4
7 D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? Left blank.
7 D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? we follow MTurk standards.
7 D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? we follow MTurk standards.
7 D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? We use MTurk and the collection is not qualified for ethics review.
7 D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? not relevant

heading: Future Work
text: NatLogAttack provides an approach to probing the existing and future NLI models’ capacity from a key viewpoint and we hope more logic-based attacks will be further explored for understanding the desired property of reasoning. Limitations
Our research focuses on the adversarial attack itself and provides a framework that can be potentially used in different adversarial training strategies. We limit ourselves on attacks in this work, but it would be interesting to investigate logic-based attacks in adversarial training. We will leave that as future work. The proposed attack approach is also limited by the limitations of natural logic, while the latter has been a classical logic mechanism. For example, our proposed framework has less deductive power than first-order logic. It cannot construct
attacks building on inference rules like modus ponens, modus tollens, and disjunction elimination. As discussed in the paper, some components of the generation and quality control process can be further enhanced