ValCAT: Variable-Length Contextualized Adversarial Transformations Using Encoder-Decoder Language Model
Abstract
Adversarial texts help explore vulnerabilities in language models, improve model robustness, and explain their working mechanisms.
However, existing word-level attack methods trap in a one-to-one attack pattern, i.e., only a single word can be modified in one transformation round, such that they cannot perturb several consecutive words as a whole.
In this paper, we propose ValCAT , a black-box attack framework that misleads the language model by applying variable-length contextualized transformations to the original text.
Compared to wordlevel methods, ValCAT expands the basic unit of perturbation from single words to spans composed of multiple consecutive words, enhancing the perturbation capability.
Experiments show that our method outperforms state-of-theart methods in terms of attack success rate, perplexity, and semantic similarity on several classification tasks and inference tasks.
More comprehensive human evaluations demonstrate that
ValCAT has a significant advantage in ensuring the fluency of the adversarial examples and achieves better semantic consistency.
We release the code at https://github.com/ linerxliner/ValCAT .
Introduction
Deep learning is successfully applied in a variety of fields, while previous works have found that neural network models are vulnerable to well-constructed adversarial examples (Goodfellow et al., 2015; Kurakin et al., 2017).
In general, adversarial examples are constructed by adding imperceptible perturbations to the benign inputs, which can mislead the victim model.
Therefore, exploring adversarial examples is essential to improve the reliability and robustness of neural network models.
However, compared to the long-studied image domain, generating adversarial examples on text is more difficult because texts are discrete,
where small changes can
[Table]
alter the original meaning and make it unnatural (Xu et al., 2020; Zhang et al., 2020).
Most of the sentence-level attack methods (Zhao et al., 2018; Han et al., 2020; Xu et al., 2021) generate adversarial examples by perturbing the latent representation of the text, and the text quality is thus relatively difficult to control.
Word-level attack methods (Samanta and Mehta, 2017;
Zhang et al., 2019) have received much attention in the recent past.
Several previous works explore the perturbation based only on the properties of individual 𝒙 (𝒙=𝒘 𝟏 𝒘 𝟐 …𝒘 𝒏 ) 𝑤 !
𝑤 " 𝑤 # 𝑤 # 𝑤 $ ...
𝑤 !
𝑤 " 𝑤 # 𝑤 % 𝑤 $ ...
(𝐼𝑛𝑑𝑒𝑥,𝐿𝑒𝑛𝑔𝑡ℎ,𝐼𝑚𝑝𝑜𝑟𝑡𝑎𝑛𝑐𝑒) : (𝑖 & ,𝑙 & ,𝑖𝑝 & ) (𝑖 ! ,𝑙 ! ,𝑖𝑝 ! )
(𝑖 " ,𝑙 " ,𝑖𝑝 " )
Rank Important Spans 𝑤 !
𝑤 " 𝑤 # 𝑤 # 𝑤 $ ...
𝑤 !
𝑤 ’ 𝑤 ’(!
𝑤 $ ... ...
Encoder
Decoder [𝑀𝐴𝑆𝐾] ... 𝑥 !,!
𝑥 !," 𝑥 !,# 𝑥 ",!
𝑥 #,!
𝑥 #," ......
𝑤 ’(" 𝑤 ’*!
Insert
Replace 𝑤 & 𝑥 !,!
𝑥 !," 𝑤 $ ... ...
𝑤 ’(" 𝑤 ’*!
𝑤 & 𝑥 ",!
𝑤 $ ... ...
𝑤 ’(" 𝑤 ’*!
𝑥 !,
# ...... 𝑤 !
𝑤 ’ 𝑤 ’(!
𝑤 $ ... ...
𝑤 ’*! 𝑦 !,!
𝑤 !
𝑤 ’ 𝑤 ’(!
𝑤 $ ... ...
𝑤 ’*! 𝑦 ",!
𝑦 ",! .....
[Figure]
Generate
[Figure] [Figure]
𝑧 "
[Figure]
$ ... ...
𝑤 ’(" 𝑤 ’*!
[Figure]
words, with the help of inflectional morphology (Tan et al., 2020), counter-fitting word vectors (Jin et al., 2020), sememe (Zang et al., 2020), etc.
The encoder language models, like BERT, give us new insights of incorporating context information into the generation of adversarial candidates in transformation (Li et al., 2020; Garg and Ramakrishnan, 2020; Li et al., 2021).
However, the basic attack units of all these works are still single words, which limits the scope of the perturbation and overlooks the interactions between words, as examples shown in Table 1.
To address this issue, two research questions are raised: 1) How to take into account interactions between words in vulnerable position discovery?
2) How to perturb a vulnerable position with variable-length contextualized transformations?
We propose ValCAT, which generates highquality adversarial examples by applying variablelength contextualized transformations to the original text.
Table 1 demonstrates some sample cases.
Specifically, given a benign text, we enumerate all possible spans by traversing the text with sliding windows of different lengths to evaluate the importance of the spans.
We utilize two operations,
R EPLACE and I NSERT , to apply adversarial spans generated by an encoder-decoder language model to the text.
The encoder can recover a mask token using a single word, while the decoder can predict the words after a prompt.
Therefore, joint use of encoder and decoder enables ValCAT to generate variable-length contextualized spans at arbitrary vulnerable position.
Furthermore, we evaluate ValCAT by attacking fine-tuned BERT on several classification tasks and inference tasks.
Experimental results show that it outperforms other baseline methods in attack success rate, perplexity, and semantic similarity.
In particular, we observe that the variable-length feature can significantly reduce perplexity, which is less than 50% compared to the best baseline.
As for the efficiency, although each multi-word transformation perturbs more words than a single-word transformation, it just requires fewer transformations toward success.
In general results, it is in a tolerable perturbation rate, which is even lower than baselines on some of the inference datasets.
A comprehensive human evaluation further verifies that ValCAT has significant advantages in fluency, grammaticality, and semantic consistency.
The main contributions of this paper are summarized as follows:
• ValCAT is the first variable-length adversarial attack method against language models,
i
e., extending the basic unit of perturbation from single words to spans.
• Our work proposes the Sliding Window for vulnerable-position discovery and the variablelength contextualized adversarial transformation which fully exploits the advantage of encoderdecoder language models.
• Automatic evaluation and human evaluation demonstrate the excellent attack effectiveness of ValCAT and the superior quality of our generated adversarial examples.
ValCAT
To further improve the attack effectiveness and simultaneously improve the fluency and semantic similarity of the adversarial examples, we propose
ValCAT , which can generate high-quality adversarial text by applying variable-length contextualized transformations with a encoder-decoder language model.
Problem Formalization
Given a victim model
F : X → Y and a text x = w 1 w 2 ...
w n − 1 w n that can be correctly classified by F , the attack goal is to generate an adversarial text ˜ x , which can confuse the model prediction, i.e. F (˜ x ) ̸ = F ( x ) .
A consecutive word sequence with length l can be denoted as a span s i : i + l .
In the soft-label black-box setting, the attacker only has access to the logit output P ( y | x ) .
The architecture, parameters, and configurations of F are unknown to the attacker.
To achieve human imperceptibility, the attacker should minimize textual perturbations and maintain semantic consistency.
ValCAT
The attack workflow of ValCAT is illustrated in Figure 1.
To locate the most-vulnerable positions for the perturbations in each iteration, ValCAT first rank the importance of s i : i + l in x with a sliding window of length 1 to MAX , as lines 2-6 in
Algorithm 1.
Based on the sorted importance span ranking R , ValCAT uses the encoder-decoder language model to generate variable-length contextualized spans, as lines 8-13.
Using two transformation operations in line 9, R EPLACE and I NSERT , we obtain a adversarial text candidate set T .
If some of the candidates can mislead the victim model,
ValCAT declares the one with the highest cosine similarity with the original text as the final successful result, as line 11.
However, if no candidate successes at this iteration, we select the one with the highest negative impact to the victim model as the basic text for the next iteration, as line 13.
Note that, if a span in the ranked list has been selected as the target span, the subsequent spans which are overlapped with the target span will be removed from the ranked list to avoid multiple modifications on a token.
The attack ends when the successful example appears, or when the upper limit of the perturbation constraints (See Section 3.1) reached.
The latter case is considered a final failure.
Below we elaborate on the two stages of the attack in
Section 2.1 and Section 2.2 in detail.
2. Important Span Ranking
Echoing the observation to prior works (Jin et al., 2020; Li et al., 2020), only some key words act as most-vulnerable positions for the victim model F .
Perturbations over these words can be most beneficial in crafting adversarial examples.
Considering the interactions between words, ValCAT performs transformations on several important spans instead of single words.
Given a text x , we evaluate the importance of a span s within x according to how removing the span can impact the model prediction in the blackbox setting.
Formally, we define the decision difference of x and ˜ x on the class y as:
D y ( x, ˜ x ) =
(cid:26) d y ( x, ˜ x ) , if y = ˜
y d y ( x, ˜ x ) + d ˜ y
(˜ x, x ) , if y ̸ = ˜
y where y and ˜ y are the predictions of x and ˜ x , respectively, and
d y ( x, ˜ x ) =
P ( y | x ) − P ( y | ˜ x ) is the difference of the probabilities that x and ˜ x are classified as y .
Let
˜ x
s denote the text of replacing span s by a unknown token [unk] .
The importance score of s with respect to x is IP x ( s ) =
D y ( x, ˜ x s ) .
To compare spans of different lengths, we propose the Sliding Windows to measure the importance of variable-length spans.
Specifically, we apply multiple sliding windows of the corresponding size, which traverse the text from left to right.
Each span bounded by a sliding window is sequentially removed from the original text for its importance calculation.
Finally, we obtain a set of triples each consisting of the start position, the length, and the importance score of a span.
We rank the triples according to the importance score in descending order.
Algorithm 1: V AL CAT
Input: Victim Model F ; Text x ; Label y ;
Maximum length of sliding window
MAX
Output: Adversarial example 1 R ← ∅ ; t ← x 2 for l = 1 to MAX do for i = 1 to LEN ( x ) − l + 1 do s ← x i,...,i + l −
Calculate span importance IP x ( s )
R ← R ∪ ⟨ i, l, IP x ( s ) ⟩ 7 Sort R by IP x ( s ) in descending order 8 for ( i , l , _) in R do
T ← R EPLACE ( t, i, l ) ∪ I NSERT ( t, i ) if ∃ ˜ x ∈ T s .
t .
F (˜ x ) ̸ =
y then
[Equation]
[Equation]
else
[Equation]
2. Variable-Length Contextualized Transformations
Based on the triple ranking, ValCAT performs sequential perturbations, where each step a target span in the original text is replaced by or inserted with a set of adversarial spans generated by an encoder-decoder language model.
The variablelength of the adversarial spans renders the language model enough space to produce more contextually appropriate candidates to improve fluency.
Meanwhile, our variable-length method expands the per- turbation forms, for it supports multi-word transformations while is compatible with traditional oneto-one transformations.
Compared with previous methods, this further improves the attack success rate under the same perturbation constraints.
Below we elaborate on the details of the adversarial span generation.
Adversarial Span Generation
To generate adversarial candidates of each span, ValCAT applies an encoder-decoder language model to fill the mask token with a list of variable-length spans.
First, the encoder language model confers the capability of predicting the masked tokens, which is trained with the masked language modeling (MLM) objective.
However, the encoder fills one mask token with only one suitable word rather than multiple words.
The ability of the decoder could fill the gap of the single word since the decoder is trained with a causal language modeling (CLM) which can predict the sequence after a prompt.
But, the decoder can only generate sequences at the end of the text.
Hence, ValCAT combined these two models with their complementary advantages, with the predictive capability at arbitrary positions of encoder and variable-length generation of a decoder.
With the candidate adversarial spans for target span, ValCAT performs two kinds of transformation operations,
R EPLACE and I NSERT , to generate the adversarial examples for consideration.
Replace
The R EPLACE operation substitutes the target span s i : i + m = w i ...
w i + m − 1 with another s .
For example, the target “ awesome ” in the text “This place is awesome.”
could be replaced by the adversarial span “ pretty good ”.
Specifically, we first replace a mask token [mask] to s i : i + m : ˜ x
[ i : i + m ] = w 1 ...w i − 1 [mask] w i + m ...w n , and generate a set of contextualized spans of varying length, S , to fill the mask token.
The adversarial example is denoted as:
[Equation]
i + m +1 ...
w n , where s ∈ S is a adversarial span.
Since the language model is blind to the information of the target span, some of the generated adversarial spans may deviate from the original meaning to a large extent.
To avoid this situation, we only keep the adversarial spans with a high degree of semantic similarity to the original span.
Specifically, we use Universal Sentence Encoder (Cer et al., 2018) to restrict their cosine semantic similarity.
We also impose a limit on the perturbation rate (See Section 3.1).
To prevent the text from being too long, we constrain the adversarial spans to be at most two words longer than the target span.
Insert
The I NSERT operation inserts a new span s in front of the target span
s i : i + m .
For example, “I like this quite interesting movie.”.
Similar to the
Replace operation, it inserts a mask token in front of the target span:
[Equation]
and corresponds with the adversarial text ˜ x is = w 1 ...
w i − 1 s w i ...w n .
This operation also follows the same perturbation constraints, mentioned in
Section 3.1.
Experiments
In this section, we evaluate ValCAT on two NLP tasks, text classification and natural language inference.
To demonstrate the effectiveness of ValCAT in terms of fluency, grammaticality, and semantic consistency, following Li et al.
2021, we design and conduct a comprehensive human evaluation.
3. Implementation Victim Model
In this work, we choose fine-tuned
BERT as the victim model for the all evaluation tasks.
As BERT has achieved good results on a variety of NLU tasks and has been proven to be one of the most representative pre-trained transformers (Devlin et al., 2019).
Span Generation Model
To obtain variablelength contextualized spans, we choose T5 (Raffel et al., 2020) as the generation model.
T5 is a representative encoder-decoder language model that can predict the missing spans within a corrupted piece of text, benefiting from the fill-in-the-blank pre-training.
Also, the large corpus C4 renders T rich prior knowledge to enable the diversity and the high quality of the generated spans.
Constraints
To achieve human imperceptibility and semantic preservation of the adversarial example, we impose constraints on the word perturbation rate and semantic similarity, as defined in Section 3.3.
Following previous practices (Jin et al., 2020;
Li et al., 2021), we set the thresholds of these constraints respectively for each dataset, with details shown in Appendix A.
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table]
MNLI
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
Settings and Computation Cost
All results are derived from a single run since there is no randomness in our method.
The maximum length of the sliding window is set as 3.
In our implementation, we apply SpaCy (Honnibal and Montani, 2017) and NLTK (Loper and Bird, 2002) for text manipulation.
We run ValCAT on Intel Xeon E52.6GHz Processor with V100 GPU.
Averagely it takes 34 secs to generate a successful adversarial example.
3. Datasets and Baselines
To investigate the effectiveness of ValCAT on different types of text, we evaluate it on several English datasets.
We randomly sample 1000 instances from each of the following datasets: three for text classification, i.e., AG News , Yelp Polarity , and IMDB ; and three for natural language inference, i.e., SNLI ,
MNLI , and QNLI , with detailed information shown in Appendix B.
To prove the effectiveness of ValCAT comprehensively, we compared ValCAT with several state-of-the-art word-level attack methods, i.e., TextBugger , TextFooler , and BERT-Attack .
Details of these methods are shown in Appendix C.
Note that, all the datasets and baselines are publicly available and are used following their usage specifications.
3. Automatic Evaluation Metrics
We evaluate the effectiveness of ValCAT based on the following metrics:
• Attack success rate (Suc) : is the percentage of adversarial examples successfully interfered with the victim model’s prediction over the text dataset.
• Perplexity (PPL) : is an automatic metric to evaluate the probability of a text appearing in a natural corpus.
So PPL can reflect the text’s natural fluency, the lower the better.
We use GPT-2 (Radford et al., 2019) for this calculation.
• Semantic similarity (Sim) : is the cosine similarity
between the original text and adversarial example calculated by Universal Sentence Encoder (USE) embedding (Cer et al., 2018).
• Word perturbation rate (Pert) : is the proportion of the modified words over the original text.
To evaluate the perturbation rate on variable-length perturbations more accurately, we design separate calculations for these two transformation operations.
For the R EPLACE operation, the number of modifications is max ( l t , l a ) − l LCS , where l t , l a , and l LCS are the lengths of the target span, the adversarial span, and their longest-commonsubsequence (LCS), respectively.
For the I NSERT operation, the number of modifications is the length of the inserted span.
• Grammar error (GErr) : is the incremental number of grammatical errors of the adversarial example relative to the original text.
We use LanguageTool 1 to count the grammatical errors within a text.
[Figure]
Results
The main experimental results are revealed in Table 2.
ValCAT outperforms baselines on multiple datasets in both classification tasks and inference tasks.
Compared with BERT-Attack, the best baseline method, ValCAT achieves higher attack success rates in all experiments and the improvement ranges from 5.9% even to 18.8%.
This is attributed to ValCAT’s ability to apply variablelength contextualized transformations on spans at any position, which largely enriches the pattern of perturbations.
In addition, ValCAT achieves the highest semantic similarity with the original text in all tasks.
The perplexity of the adversarial example generated by ValCAT is far superior to that of the baselines.
It is roughly only 50% of the perplexity of BERT-Attack and is almost consistent with the original text.
This indicates that the adversarial example generated by ValCAT is with high fluency.
The underlying reason is that multi-word transformations render the language model enough space to generate the adversarial spans with approximated distribution with natural language.
At the same time, ValCAT reaches the lowest average increase in the number of grammatical errors on five out of nine attacks, with only a slight disadvantage on the natural language inference tasks.
In general, ValCAT generates adversarial examples that achieve more promising attacks and are more imperceptible to humans.
Figure 2 shows the performance of ValCAT and baselines on the Yelp dataset under different constraint settings.
As we can see, the success rate of ValCAT decays most slowly as the limits of perturbation rate and semantic similarity increase, still achieving a success rate of almost 70% under the strictest constraint.
Moreover, ValCAT can maintain a low perplexity under any constraint, however, other attack methods have to sacrifice attack success rate to maintain their fluency.
3. Human Evaluation Design
We evaluate the quality of the adversarial examples from three perspectives: fluency and grammaticality, semantic similarity, and label consistency.
The first two metrics are evaluated by ratings, while the third one lets the annotator categorize the texts into a set of labels.
Five annotators with CET-4 certification performed the evaluation on AG News dataset.
All annotators were informed and consented to the use of the annotation, and were paid with remuneration higher than the regional average.
To construct the dataset for human evaluation, we randomly select 100 samples from the dataset, whose adversarial examples generated by both ValCAT and BERT-Attack can mislead the victim model to make the same wrong classification decision among multiple classes.
For the evaluation of fluency and grammaticality, each original text and its two adversarial examples are presented in one group in a shuffled order and the annotators are asked to rate them.
For the evaluation of semantic similarity, given the original text, the judges need to separately evaluate its semantic similarity with the two adversarial examples presented in random order.
The above two tasks ask the annotators to rate the text or the text pair from 1 to 5.
In each questionnaire, we give explicit criteria and clear ex-
[Table]
amples for every score.
For the evaluation of label consistency, we mix all the original texts with the adversarial examples and let the annotators label the category of them, e.g., business or technology.
Results
For the two rating tasks, we normalize the rates of the annotators and calculate the average score, while for the labeling task we take the majority vote as the final result.
As shown in Table 3, ValCAT is rated with much higher fluency and grammaticality scores than BERT-Attack.
Also, it achieves obviously higher semantic similarity.
In terms of labeling accuracy, ValCAT slightly outperforms BERT-Attack, still indicating that ValCAT makes smaller changes to the meanings of the text from the aspect of human perception.
All these results demonstrate the superior quality of the adversarial examples generated by ValCAT
Analysis 4. Ablation Study
We evaluate different transformation strategies of
ValCAT as in Table 4.
3-Many results in the lowest perplexity, as it renders the language model more space to generate a proper adversarial span.
It also requires the smallest number of queries, and we speculate the reason as it perturbs more words in a single transformation.
For the same reason, 3-Many is less likely to succeed since it’s easier to reach the perturbation constraint.
As expected, the combination of multiple types of R EPLACE operations facilitates the attack success rate while increasing the number of queries.
The I NSERT operation achieves high semantic similarity while requiring a large number of queries.
A comprehensive utility of all operations (i.e., ValCAT) achieves the highest success rate with the lowest perturbation rate, which fully demonstrates the advantages of the transformation diversity.
[Table]
4. Impact of Candidate Numbers
From the results under different numbers of candidate spans shown in Figure 3, we observe that the attack success rate is higher when there are more candidates.
Since we greedily select the adversarial span with the greatest impact on the decision of the victim model, as the number of candidates increases, spans with low occurrence probability can be added to the text, making the perplexity higher.
This is especially true for difficult-to-attack datasets like AG News.
[Figure]
4. Properties of Transformations
We observe the properties of the transformations in the successful adversarial examples from three perspectives: type of operation, length of span, and
POS (part-of-speech) of span.
Averagely, 62% of the transformations in each example are R EPLACE operations, and 38% are I NSERT operations, indicating that R EPLACE operations are more effective in most cases.
As shown in Table 10, the replaced spans are most likely the longer ones, while the adversarial spans being applied are relatively short.
Additionally, Table 11 shows that the adversarial spans of R EPLACE operation share identical POS distribution with the replaced spans, which guarantees the fluency of the adversarial example.
The
I NSERT operation tends to use adverbs and adjectives, which is consistent with the human intuition of inserting words into text.
4. Adversarial Training
We investigate how adversarial training can mitigate the adversarial attack, that is, the power of our adversarial examples for adversarial training as a general defense.
We randomly sample 10, instances from the Yelp training dataset and apply
ValCAT to generate adversarial examples.
These adversarial examples and their intermediate results, approximately 60,000 texts, are then used to finetune the attacked BERT under the gold labels.
After adversarial training, the accuracy of the victim model on the test dataset slightly decreases from 98.3% to 98.0%, which means that adversarial training does not affect the performance of the model on clean data.
As shown in Table 5, the attack success rate of ValCAT drops by about 20%, while both the perturbation rate and the number of queries have significantly increased, indicating that the victim model is harder to attack after the adversarial training.
[Table]
4. Generalization
We evaluate the generalization of ValCAT in two aspects: 1) attack on other victim models and 2) transferability.
[Table]
Attack on Other Victim Models
We try to attack other common language models on the Yelp dataset using ValCAT.
Table 6 shows that LSTM and wordCNN, two traditional NLP models, are extremely vulnerable to ValCAT with an attack success rate of around 99%.
Interestingly, RoBERTa shows better robustness, with a 6.5% decrease in attack success rate relative to BERT, which we speculate is due to its more optimized pre-training approach.
Transferability
We evaluate the transferability of generated adversarial examples on the Yelp dataset.
Specifically, we utilize successful adversarial examples generated by ValCAT targeting different victim models to attack other tested models.
Results in Table 7 show that adversarial examples aimed at transformer models (BERT and
RoBERTa) are more effective in attacking traditional NLP models (LSTM and wordCNN) than the opposite case.
[Table]
4. Limitation
ValCAT makes the best effort to improve the effectiveness of the attack, including the Sliding Window with a variable-length mechanism to discover vulnerable positions and multiple types of transformation operations.
However, all these efforts result in a larger number of queries to the victim model, compared to existing word-level attack methods.
According to the results of the automatic evaluation and human evaluation, such an increase in the computation expense is tolerable, considering the significant improvement in attack success rate and adversarial example quality.
Furthermore, a simplified version of ValCAT, 1-Many (See Table 4), outperforms the best baseline methods in all aspects, including the number of queries.
Further, the encoder-decoder language models targeting the fill-in-the-blank-style denoising objectives cannot see the masked original spans during the training and inference.
This limitation of encoder-decoder leaves improvement space of semantic similarity for ValCAT, i.e., establishing a direct semantic mapping between the generated span and the original span themselves in each transfor- mation.
We leave finding better ways of training to compensate for the invisibility of encoder-decoder as our future work.
Related Work
Textual adversarial attacks have been intensively studied (Wang et al., 2019; Zhang et al., 2020).
Early on, the character-level attack methods (Ebrahimi et al., 2018; Gao et al., 2018; Li et al., 2019) are widely used, but they would destroy words and are very perceptible (Pruthi et al., 2019).
Word-level attack methods are now in the spotlight, evolving from substitution based only on the properties of individual words themselves (Zang et al., 2020; Jin et al., 2020; Tan et al., 2020) to perturbing words by multiple strategies with knowledge of the context (Li et al., 2020; Garg and Ramakrishnan, 2020;
Li et al., 2021)
Although these existing works may enrich the transformation form with various operations like insertion, deletion, merging, etc., they still treat single words as basic units of each transformation.
Some sentence-level works (Wang et al., 2020a; Wang et al., 2020b; Huang and
Chang, 2021) generate adversarial examples by perturbing the latent representation of the original text, but they are slightly worse at controlling the text quality.
Our work introduces the Sliding Window to rank important spans and generates variable-length contextualized spans by the encoder-decoder language model, enabling more effective adversarial attacks and higher quality adversarial examples.
Conclusion
In this paper, we propose ValCAT, the first variablelength contextualized adversarial attack based on the encoder-decoder language model.
ValCAT considers the interaction between words for the vulnerable-position discovery and expands the basic unit of perturbation from single words to spans.
Experimental results on several datasets demonstrate the effectiveness of our methods, which outperforms baselines in terms of attack success rate, perplexity, and semantic similarity.
The generated adversarial examples also have good transferability and help to improve robustness.
A comprehensive human evaluation further verifies the high quality of the adversarial examples generated by ValCAT.
Acknowledgements
This work is supported in part by National
Natural Science Foundation of China (Grant
No. U1836213, U19B2034), National Key R&D
Plan (Grant No.
2018YFB2101501), Industrial Internet Innovation and Development Project (Grant No. TC200H02X, TC200H02Y), and
the
Huawei Technologies Co., Ltd under Grant No.
TC20200917004.
A Constraints
We impose constraints on the generated adversarial examples in terms of perturbation rate and semantic similarity, as shown in Table 8.
[Table]
B Datasets
We employ three datasets for text classification and three datasets for natural language inference as described below.
In our experiments, we randomly sample 1000 instances.
• AG News : a collection of news articles categorized into 4 types: World, Sports, Business, and Sci/Tech (Zhang et al., 2015).
• Yelp Polarity : positive and negative restaurant reviews collected from yelp (Zhang et al., 2015).
• IMDB : a dataset of movie reviews for binary sentiment classification (Maas et al., 2011).
• SNLI : a collection of human-written English sentence pairs (Bowman et al., 2015).
Each sentence pair consists of a premise and a hypothesis, which is necessary to determine whether it is entailment, contradiction, or neutral.
• MNLI : a similar dataset to SNLI (Williams et al., 2018), but from a variety of genres.
• QNLI : a version of SQuAD which has been converted to a binary classification task (Wang et al., 2018).
C Baselines
We compare ValCAT with state-of-the-art wordlevel attack methods:
• TextBugger : an attack model compounded by five bug generation strategies (Li et al., 2019).
Such strategies include character insertion, character deletion, character swapping, homograph character replacement, and synonym replacement.
• TextFooler : classical adversarial attack algorithm based on synonym substitution (Jin et al., 2020).
Candidate synonyms are the closest neighbors of the replaced word in the counter-fitting word embedding space.
It limits the cosine semantic similarity and makes the POS consistent.
• BERT-Attack : a state-of-the-art contextualized attack method using BERT to fill mask tokens (Li et al., 2020).
It serves as a representative of similar BERT-based algorithms, such as BAE (Garg and Ramakrishnan, 2020) and CLARE (Li et al., 2021).
D Performance of Encoder-Decoder Models
We present the results of generating adversarial spans by several language models in the T5 family in Table 9.
T 5 large and mT 5 base take a longer time to generate adversarial spans due to their larger capacity.
The higher perplexity of T 5 v 1 . 1 base is, we conjecture, resulted from its specifically different structure.
In short, T 5 base is good enough for adversarial span generation.
[Table]
E Properties of Transformations
We observe the properties of the transformations in the successful adversarial examples from three perspectives: type of transformation, length of span, and POS (part-of-speech) of span.
Results are shown in Table 10 and Table 11.
Replaced Span
[Table] [Table]
[Table] [Table]
Span
[Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]