Adversarial Texts with Gradient Methods

Adversarial samples for images have been extensively studied in the literature. Among many of the attacking methods, gradient-based methods are both effective and easy to compute. In this work, we propose a framework to adapt the gradient attacking methods on images to text domain. The main difficulties for generating adversarial texts with gradient methods are: (i) the input space is discrete, which makes it difficult to accumulate small noise directly in the inputs, and (ii) the measurement of the quality of the adversarial texts is difficult. We tackle the first problem by searching for adversarials in the embedding space and then reconstruct the adversarial texts via nearest neighbor search. For the latter problem, we employ the Word Mover’s Distance (WMD) to quantify the quality of adversarial texts. Through extensive experiments on three datasets, IMDB movie reviews, Reuters-2 and Reuters-5 newswires, we show that our framework can leverage gradient attacking methods to generate very high-quality adversarial texts that are only a few words different from the original texts. There are many cases where we can change one word to alter the label of the whole piece of text. We successfully incorporate FGM and DeepFool into our framework. In addition, we empirically show that WMD is closely related to the quality of adversarial texts. I . I N T R O D U C T I O N It has been shown that carefully crafted noise may trick the deep neural networks into wrong predictions with very high confidence . Many followup work proposed cheap yet effective methods to find such adversarial noise, e.g., fast gradient method (FGM) , Jacobian-based saliency map approach (JSMA) , CW , etc. We have seen that the investigation of adversarial samples for image models has provided us new perspectives to understand the mechanism of deep neural networks, e.g., linear hypothesis [6], rethinking smoothness assumptions . In addition, many algorithms have been proposed to enhance the robustness of the deep models, e.g., adversarial training [6]. However, most of the previous work focused on images. Only a few attempts have been made in text domain. We think it is worthwhile to investigate adversarial samples for text models as well. In this work, we propose a simple and effective framework to adapt the adversarial attacking methods for images to text domain. Specifically, we focus on gradient-based method since they are very fast in practice. There are two major problems we need to resolve before we can plugin the gradient based methods for generating adversarial images. 1) The input space is discrete. As a result, it is not possible to accumulate small noise computed with gradient methods directly in the input space. They work well in image domain since image models usually take input in a continuous domain [0, 1]. 2) It is difficult to quantify the quality of adversarial texts. For adversarial images, we usually utilize p-norm distance, perceptual distance , etc. While for adversarial texts, there are no good metrics to measure the quality. In this work, we propose a general framework in which we generate adversarial texts via slightly modified gradientbased attacking methods. We first search for adversarials in the text embedding space [17] via gradient-based methods and then reconstruct the adversarial texts via nearest neighbor search. In addition, we also empirically evaluate using Word Mover’s Distance (WMD) [11] as a quality measurement for the adversarial texts. The advantage of our framework is that no manual features are needed. This paper is organized as follows. We briefly review recent work on generating adversarial images and texts in Section II. Our adversarial text framework is detailed in Section III. We evaluate our method on various text benchmarks and report the results in Section IV. We conclude this paper and provide directions for future work in Section V. I I . R E L AT E D W O R K The existence of adversarial samples was first discussed in . There has been an abundance of work on attacking methods to generate adversarial images. These adversarial images raise security concerns about the wide application of deep neural networks [10]. As a result, many work have investigated defense against these adversarial samples. However, so far as we see in literature, the attacking is much easier and cheaper than defense. For notation, x denotes the input, y the prediction, f the target model such that y = f(x), L the loss function, x∗ the adversarial sample. ‖·‖p denotes the p-norm. We slightly abuse the notation here, Lx denotes the loss with x as the input. The attacking methods mainly fall into three categories, gradient attack, optimization attack and model attack. Generally speaking, gradient attack is faster than the others. However, the other two require much less knowledge about the model, thus more practical. In addition, optimization attacks are usually more effective and generate more subtle noise. A. Adversarial Image Method 1) Gradient Attack: This class of attacking methods rely on target model gradients, thus requiring full knowledge of ar X iv :1 80 1. 07 17 5v 1 [ cs .C L ] 2 2 Ja n 20 18