Adversarial attacks for discrete data ( such as texts ) have been proved significantly more challenging than continuous data ( such as images ) since it is difficult to generate adversarial samples with gradient-based methods . Current successful attack methods for texts usually adopt heuristic replacement strategies on the character or word level , which remains challenging to find the optimal solution in the massive space of possible combinations of replacements while preserving semantic consistency and language fluency . In this paper , we propose BERT-Attack , a high-quality and effective method to generate adversarial samples using pre-trained masked language models exemplified by BERT . We turn BERT against its fine-tuned models and other deep neural models in downstream tasks so that we can successfully mislead the target models to predict incorrectly . Our method outperforms state-of-theart attack strategies in both success rate and perturb percentage , while the generated adversarial samples are fluent and semantically preserved . Also , the cost of calculation is low , thus possible for large-scale generations . The code is available at https://github.com/ LinyangLee / BERT-Attack . Despite the success of deep learning , recent works have found that these neural networks are vulnerable to adversarial samples , which are crafted with small perturbations to the original inputs ( Goodfellow et al . , 2014 ; Kurakin et al . , 2016 ; Chakraborty et al . , 2018 ) . That is , these adversarial samples are imperceptible to human judges while they can mislead the neural networks to incorrect predictions . Therefore , it is essential to explore these adversarial attack methods since the ultimate goal is to make sure the neural networks are highly reliable and robust . While in computer vision fields , both attack strategies and their defense countermeasures are well-explored ( Chakraborty et al . , 2018 ) , the adversarial attack for text is still challenging due to the discrete nature of languages . Generating of adversarial samples for texts needs to possess such qualities : ( 1 ) imperceptible to human judges yet misleading to neural models ; ( 2 ) fluent in grammar and semantically consistent with original inputs . Previous methods craft adversarial samples mainly based on specific rules ( Li et al . , 2018 ; Gao et al . , 2018 ; Yang et al . , 2018 ; Alzantot et al . , 2018 ; Ren et al . , 2019 ; Jin et al . , 2019 ; Zang et al . , 2020 ) . Therefore , these methods are difficult to guarantee the fluency and semantically preservation in the generated adversarial samples at the same time . Plus , these manual craft methods are rather complicated . They use multiple linguistic constraints like NER tagging or POS tagging . Introducing contextualized language models to serve as an automatic perturbation generator could make these rules designing much easier . The recent rise of pre-trained language models , such as BERT ( Devlin et al . , 2018 ) , push the performances of NLP tasks to a new level . On the one hand , the powerful ability of a fine-tuned BERT on downstream tasks makes it more challenging to be adversarial attacked ( Jin et al . , 2019 ) . On the other hand , BERT is a pre-trained masked language model on extremely large-scale unsupervised data and has learned general-purpose language knowledge . Therefore , BERT has the potential to generate more fluent and semantic-consistent substitutions for an input text . Naturally , both the properties of BERT motivate us to explore the possibility of attacking a fine-tuned BERT with another BERT as the attacker . In this paper , we propose an effective and high-quality adversarial sample generation method : BERT-Attack , using BERT as a language model to generate adversarial samples . The core algorithm of BERT-Attack is straightforward and consists of two stages : finding the vulnerable words in one given input sequence for the target model ; then applying BERT in a semantic-preserving way to generate substitutes for the vulnerable words . With the ability of BERT , the perturbations are generated considering the context around . Therefore , the perturbations are fluent and reasonable . We use the masked language model as a perturbation generator and find perturbations that maximize the risk of making wrong predictions ( Goodfellow et al . , 2014 ) . Differently from previous attacking strategies that require traditional single-direction language models as a constraint , we only need to inference the language model once as a perturbation generator rather than repeatedly using language models to score the generated adversarial samples in a trial and error process . Experimental results show that the proposed BERT-Attack method successfully fooled its finetuned downstream model with the highest attack success rate compared with previous methods . Meanwhile , the perturb percentage and the query number are considerably lower , while the semantic preservation is high . To summarize our main contributions : • We propose a simple and effective method , named BERT-Attack , to effectively generate fluent and semantically-preserved adversarial samples that can successfully mislead stateof-the-art models in NLP , such as fine-tuned BERT for various downstream tasks . • BERT-Attack has a higher attacking success rate and a lower perturb percentage with fewer access numbers to the target model compared with previous attacking algorithms , while does not require extra scoring models therefore extremely effective . In this work , we propose a high-quality and effective method BERT-Attack to generate adversarial samples using BERT masked language model . Experiment results show that the proposed method achieves a high success rate while maintaining a minimum perturbation . Nevertheless , candidates generated from the masked language model can sometimes be antonyms or irrelevant to the original words , causing a semantic loss . Thus , enhancing language models to generate more semantically related perturbations can be one possible solution to perfect BERT-Attack in the future .

Challenge: Generating adversarial samples with gradient-based methods for text data is because of its discrete nature and existing complicated heuristic-based methods suffer from finding optimal solutions.
Approach: They propose to use BERT to generate adversarial samples by first finding the valuable words and generating substitutes for these words in a semantic-preserving way.
Outcome: The proposed method outperforms state-of-the-art methods in success rate and perturb percentage while preserving fluency and sematic of generated samples with low cost.