A DVERSARIAL E XAMPLES FOR N ATURAL L ANGUAGE C LASSIFICATION P ROBLEMS
Anonymous authors
Paper under double-blind review
A BSTRACT
Modern machine learning algorithms are often susceptible to adversarial examples — maliciously crafted inputs that are undetectable by humans but that fool the algorithm into producing undesirable behavior.
In this work, we show that adversarial examples exist in natural language classiﬁcation: we formalize the notion of an adversarial example in this setting and describe algorithms that construct such examples.
Adversarial perturbations can be crafted for a wide range of tasks — including spam ﬁltering, fake news detection and sentiment analysis — and affect different models — convolutional and recurrent neural networks as well as linear classiﬁers to a lesser degree.
Constructing an adversarial example involves replacing 10-30% of words in a sentence with synonyms that don’t change its meaning.
Up to 90% of input examples admit adversarial perturbations; furthermore, these perturbations retain a degree of transferability across models.
Our ﬁndings demonstrate the existence of vulnerabilities in machine learning systems and hint at limitations in our understanding of classiﬁcation algorithms.
I NTRODUCTION
Modern machine learning algorithms are often susceptible to adversarial examples — maliciously crafted inputs that are undetectable by humans but that fool the algorithm into producing undesirable behavior.
Adversarial examples arise in image classiﬁcation (Szegedy et al., 2014),
speech recognition (Carlini et al., 2016), reinforcement learning (Behzadan & Munir, 2017) and in other domains.
The existence of adversarial inputs has obvious security implications and also reveals important shortcomings in our understanding of modern machine learning algorithms.
In this work, we study adversarial perturbations in the context of natural language, and show that common text classiﬁcation algorithms are affected by adversarially crafted inputs.
Our work formalizes the notion of an adversarial example in natural language classiﬁcation and proposes algorithms for constructing such examples.
We also investigate reasons that give rise to adversarial examples, and identify two distinct factors affecting the vulnerability of a model; the ﬁrst originates in the embedding layer of a neural network classiﬁer, while the second originates in the hidden layers.
Constructing adversarial inputs typically involves replacing 10-30% of words in a sentence with synonyms that don’t change its original meaning.
Our experiments suggest that such inputs can be consistently constructed across multiple domains — including spam classiﬁcation, fake news detection, and sentiment analysis — and in different models — convolutional and recurrent neural networks as well as linear classiﬁers to a lesser degree.
Up to 90% of input examples admit adversarial perturbations; furthermore, these perturbations retain a degree of transferability across models.
Our ﬁndings suggest the existence of vulnerabilities in text classiﬁcation systems and hint at limitations in our understanding of these systems.
More generally, our work highlights the need to further investigate adversarial inputs in natural language tasks as well as in classiﬁcation problems over discrete inputs.
Task:
Spam ﬁltering.
Classiﬁer: LSTM.
Original label: 100% Spam.
New label: 89% Non-Spam.
Text : your application petition has been accepted recognized thank you for your loan borrower request petition , which we recieved yesterday , your reﬁnance subprime application petition has been accepted recognized good credit or not , we are ready to give you a $ oov loan , after further review , our lenders have established the lowest monthly payments .
approval process will take only 1 minute .
please visit the conﬁrmation link below and ﬁll-out our short 30 second secure web-form .
http : oov
Task: Sentiment analysis.
Classiﬁer: CNN.
Original label: 81% Positive.
New label: 100% Negative.
Text : i went moved to wing wednesday which is all-you-can-eat wings for $ oov even though they raise the prices it ’s still ever really great deal .
you can eat as many wings you want to get all the different ﬂavors tastes and have a good time enjoying the atmosphere .
the girls are smoking hot !
all the types of sauces dressings are awesome !
and i had at least 25 wings in one sitting .
i would deﬁnitely certainly go again just simply not every wednesday friday maybe once a month .
Task: Fake news detection.
Classiﬁer: Naive Bayes.
Original label: 97% Fake.
New label: 100% Real
Text : trump supporter whose brutal ferocious beating by black mob gangsta was caught on video tape asks demands : “ what happened to america ? ”
[ video ] , ” david oov , a 49 year old former chicago rochester man who was brutally beaten by a mob lowlife of black democrats asks demands , “ what happened to america ? ”
here is his very sad disappointing story
B ACKGROUND
We study classiﬁcation problems, in which the goal is to learn a mapping f : X → Y from an input x ∈ X to a target label y ∈ Y , which lies in some ﬁnite set of K classes Y =
{ y 1 , y 2 , ..., y K } .
The classiﬁer f associates a score f y k ( x ) to each class y k and outputs the class with the highest score.
In this paper, f will be parametrized by a deep neural network or a linear model.
2. A DVERSARIAL E XAMPLES AND I MAGE C LASSIFICATION
Despite recent successes, modern classiﬁcation algorithms based on deep neural networks are susceptible to adversarial examples (Szegedy et al., 2014), which are maliciously crafted inputs that are indistinguishable from real examples by humans, but that cause the algorithm to misbehave.
In the context of image classiﬁcation, given a classiﬁer f , we say that x (cid:48) is an adversarial perturbation of x targeting class y (cid:48)
(distinct from the true class y of x ) if
[Equation]
The norm (cid:107)·(cid:107) captures the notion of an imperceptible perturbation; popular choices include the (cid:96)or the (cid:96) ∞ norms.
For simplicity, we refer to x (cid:48) as an adversarial example for f .
Adversarial examples can be obtained by solving an optimization problem of the form
[Equation]
in which the objective J ( x (cid:48) ) measures the extent to which x (cid:48) is adversarial and may be a function of a target class y (cid:48)
[Equation]
=
[Equation]
, e.g
[Equation]
x (cid:48) ) .
Algorithms for solving the above objective include the
Fast Gradient Sign method or iterative methods based on constrained gradient descent (Goodfellow et al., 2014; Papernot et al., 2016).
2. C LASSIFYING N ATURAL L ANGUAGE U TTERANCES
Text classiﬁcation problems arise in varous domains, including biomedical (Aggarwal & Zhai, 2012), spam ﬁltering (Androutsopoulos et al., 2000), and ﬁnancial (Schumaker & Chen, 2009).
Linear classiﬁers with n -gram features often perform surprisingly well on text classiﬁcation benchmarks (Wang & Manning, 2012).
In recent years, variants of recurrent networks — especially classiﬁers based on long short-term memory (Hochreiter & Schmidhuber, 1997) — have helped improve state-of-the-art accuracy; most recently, convolutional neural networks have been shown to be competitive with recurrent methods (Kim, 2014; Zhang et al., 2015)
Natural language classiﬁcation problems distinguish themselves from image classiﬁcation by their discrete nature (the inputs x consist of discrete symbols such as characters or words) and by their higher dimensionality, which is typically proportional to vocabulary size.
Furthermore, natural language representations are in a sense “higher-level” than image pixels, since they raw words encode signiﬁcantly more meaning than raw pixel values.
These differences pose natural constraints on the notion of an adversarial example, which our work explores.
A DVERSARIAL E XAMPLES FOR N ATURAL L ANGUAGE C LASSIFICATION
This work explores adversarial examples in the context of natural language classiﬁcation.
Deﬁning adversarial inputs for text classiﬁers is complicated by two problems: ﬁrst, there is no simple notion of metric between utterances (making it difﬁcult to deﬁne an imperceptible perturbation); second, discrete inputs are not amenable to gradient-based methods and thus require new optimization algorithms.
In this section, we ﬁrst propose a general notion of adversarial perturbation that applies to both continuous and discrete inputs.
Then, we instantiate this notion in the context of language classiﬁcation.
Finally, we propose a general optimization algorithm for constructing adversarial inputs; the following section examines our approach experimentally.
3. A LTERED A DVERSARIAL E XAMPLES
A large class of adversarial inputs are formed by adding imperceptible perturbations to ordinary dataset samples.
We propose to refer to this general type of adversarial attack as altered adversarial examples.
Given a classiﬁer f , we say that x (cid:48) is an adversarial alteration of x targeting class y (cid:48)
if
[Equation]
for some domain-speciﬁc constraint function c : X × X → R L + and a vector of bounds γ ∈ R L that capture the notion of imperceptible alteration via L ≥ 1 constraints.
For example, in the context of chemical molecules, we may use c to capture the edit distance between x and x (cid:48) or the similarity of the molecules’ three-dimensional structure.
In the context of image classiﬁcation, we recover the original notion of adversarial examples by taking c to be an (cid:96) 2 or (cid:96) ∞ norm constraint.
Our deﬁnition in contrast to other types of adversarial inputs explored in the literature.
These include obfuscated examples (Carlini et al., 2016) — in which the input appears as white noise but triggers unwanted behavior (e.g., audio that turns on a smartphone) — and concatenative examples (Jia &
Liang, 2017) — in which the input is combined with a distracting sequence that contains irrelevant information.
Altered examples, on the other hand, encompass the original notion of adversarial perturbation, and apply in arguably more common settings, such as in classiﬁcation.
3. A DVERSARIAL E XAMPLES FOR N ATURAL L ANGUAGE C LASSIFICATION
In a natural language context, we would intuitively like the altered examples x (cid:48) to retain the same meaning as the original x .In some settings, it may also be sufﬁcient to generate examples that humans and machines classify into different classes, without requiring that they exactly paraphrase the initial input.
To capture the above intuition, we propose to use a specially-crafted constraint function c ( x, x (cid:48) ) ; the goal of this function is to ensure that both utterances share the same meaning and retain common syntactic properties (e.g. the style of writing should remain similar).
Speciﬁcally, the function c is comprised on two constraints that capture sentence similarity on two levels.
Semantic similarity.
We propose capturing the meaning of an utterance using the notion of a thought vector (Bengio et al., 2003; Mikolov et al., 2013).
A thought vector can be seen as a mapping from sentences to a vector space, in which sentences with similar meanings are close to each other.
In this context, our constraint is deﬁned as
[Equation]
where v and v (cid:48) are thought vectors associated with x and x (cid:48) , respectively, and γ 1 is a hyperparameter.
There exist many ways of computing thought vectors for sentences, most of which will be compatible with our optimization algorithm.
In the rest of the paper, we will restrict our attention to thought vectors that are averages of the vectors for individual words.
Syntactic similarity.
Generally, thought vectors do not capture the syntactic validity of a sentence; for example, rearranging all the words in a sentence will produce the same word vector average.
To ensure that adversarial sentences are well-formed, we introduce a syntactic constraint, which relies on a language model P : X → [0 , 1] .
Speciﬁcally, we require that the language model probability be similar between the perturbed and the original example.
[Equation]
We suggest training a language model on the same dataset as f ; this allows the model to capture the extent to which x “looks like” a spam message or a movie review.
We also require that the language model probabilities of x and x (cid:48) be similar: thus if x is an ungrammatical sentence (i.e. a review uses incorrect English), then x (cid:48) should retain a similar level of correctness.
3. G REEDY C ONSTRUCTION OF A LTERED A DVERSARIAL E XAMPLES
Altered adversarial examples can be obtained by solving an optimization problem of the form
[Equation]
in which the objective J ( x (cid:48) ) measures the extent to which x (cid:48) is adversarial and may be a function of a target class y (cid:48)
(cid:54) =
y , e.g. J ( x (cid:48) )
=
f y (cid:48)
( x (cid:48) ) .
We propose solving this optimization problem approximately using a greedy heuristic outlined as Algorithm 1.
In brief, we propose an iterative procedure that considers at each step all valid one-word changes to a sentence (i.e. which satisfy our constraints) and chooses the one that improves the objective the most.
This procedure effectively replaces individual words with their synonyms, resulting in a new sentence of the same length that approximately preserves the original meaning.
Algorithm 1: for
Data : Datapoint x , termination threshold τ , neighborhood size N , parameters γ 1 , γ 2 , δ .
We initialize the algorithm at the uncorrupted data point: x (cid:48)
← x ; while Objective is below the threshold J ( x (cid:48) ) < τ and fraction of words replaced is less than δ do
Create a working set W = ∅ ; for each word w in x do for each word ¯ w among the N closest to w and different from w do substitute w (cid:48) with ¯ w to get ¯ x and if ¯ x satisﬁes Equ. (5), then W ← W ∪ { x (cid:48) } ;
Choose highest scoring world replacement x (cid:48) ← arg max ¯ x ∈ W J (¯ x ) or if W = ∅ , then break ; return x (cid:48) ;
Algorithm inputs.
Algorithm 1 requires access to a target classiﬁer f ; it transforms x into x (cid:48) by optimizing the objective J .
We assume that x is a set of n discrete symbols called words and denoted by w i for i = 1 , 2 , ..., n .
Although we deﬁne our algorithm in the context of natural language, it easily extends to general discrete problems as well.
[Table]
Optimization strategies.
First, we place a bound δ on the fraction of words that can be substituted, i.e. (cid:80) ni
=
I { w i (cid:54) = w (cid:48) i } ≤ δ · n ; this enables us to “give up” on an example when it clearly does not admit an adversarial alteration.
We also set a minimum threshold τ on the objective (e.g. the minimum desired score of the target label) and terminate when we reach it.
Word replacement.
We replace words with their nearest neighbors in a suitable word vector space, and consider the N closest neighbors.
Thus, the neighbors are normally words that are likely to occur in the same context as the original word.
To ensure that the replacements are also synonyms, we use the GloVE word vectors post-processed by with the method of Mrkˇsi´c et al.
; this ensures that the vectors satisfy linguistic constraints imposed by known synonym relations, and ensures that words with a similar meaning appear close to each other in the vector space (see Table 1).
E XPERIMENTS 4. T ASKS
We study adversarial examples on three natural language classiﬁcation tasks, summarized in Table 2.
We held out 10% of the training set for validation; all adversarial examples are generated and evaluated on the test set.
Likewise, we trained a trigram language model on the training set of each task and we instantiated the semantic constraint with the word vectors of Mrkˇsi´c et al.
We describe our three classiﬁcation tasks below.
[Table]
Spam ﬁltering.
The TREC
Public Spam Corpus ( Trec07p ) contains 50, spam emails and 25,220 ham (non-spam) emails.
We preprocess the data by removing all meta data and HTML tags.
There is no standard split for this dataset, so we randomly pick 10% as a test set.
Sentiment analysis.
The Yelp Review
Polarity dataset ( Yelp ; Zhang et al., 2015) consists of almost 600,000 customer reviews from Yelp, covering primarily restaurant reviews.
Each review is labeled as either positive or negative.
Fake news detection.
The News dataset (McIntire, 2017) contains 6,336 articles scraped from online sources, and includes both real and fake news.
Each article contains a headline and body text (which we concatenated before classiﬁcation) and is associated with a binary label.
4. M ODELS
We study adversarial example on a range of models that are widely used for classiﬁcation; these include both linear classiﬁers and state-of-the-art deep learning algorithms.
Naive Bayes.
This linear model has a long history in text classiﬁcation and it is still popular for its simplicity.
We convert each document into a bag-of-words representation, and following Wang & Manning (2012), we binarize the word features and use a multinomial model for classiﬁcation.
Long short-term memory.
Long-short term memory (LSTM; Hochreiter & Schmidhuber, 1997) is widely used in sequence modeling.
We built a single-layer LSTM with 512 hidden units as in
Zhang et al. (2015).
The input to the LSTM is ﬁrst transformed to a 300-dimensional vector using pretrained word2vec embeddings (Mikolov et al., 2013).
We then average the outputs of the LSTM at each timestep to obtain a feature vector for a ﬁnal logistic regression to predict the sentiment.
Shallow word-level convolutional networks.
An alternative approach to text classiﬁcation are convolutional neural networks (CNNs; Kim, 2014)
We train a CNN with an embedding layer (as in the LSTM) a temporal convolutional layer, followed by max-pooling over time, and a fully connected layer for classiﬁcation.
We use a uniform ﬁlter size of 3 in each convolutional feature map; all other settings are identical to those of Kim (2014).
Deep character-level convolutional networks.
We implement the character-level network of
Conneau et al.
(2016), which includes 4 stages.
Each stage has 2 convolutional layers with batch normalization and 1 max-pooling layer; convolutional and pooling layers have strides of 1 and 2, respectively and ﬁlters of size 3.
We start with 64 feature maps, and double the amount after each pooling step, concluding with k-max pooling layer with k = 8 .
The resulting activations in Rare classiﬁed by 3 fully connected layers.
4. M AIN E XPERIMENTS
[Table]
each dataset.
CLN, RND, and ADV stand for clean, randomly corrupted, and adversarially corrupted inputs, respectively.
Table 3 shows the accuracy of each classiﬁcation model on the three datasets as well as on adversarial inputs generated using Algorithm 1.
We manually selected the optimization settings that led to a reasonable tradeoff between the strength and the coherence of the adversarial examples.
Speciﬁcally, in all experiments, we used a target of τ = 0 .
7 , a neighborhood size of N = 15 , and parameters γ 1 = 0 .
2 and δ = 0 .
5 ; we set the syntactic bound to γ 2 = 2 nats for sentiment analysis and fake news detection and γ 2 = ∞ for spam; spam messages were often malformed an the language model was no longer useful.
We also compare against random perturbations obtained by replacing the arg max in Algorithm 1 with random sampling.
All models are susceptible to adversarial examples to a certain degree, which depends in part on the task.
Certain problems, such as spam ﬁltering seem easier to classify and are less amenable to adversarial inputs; conversely, it is easier to fool the models on more difﬁcult tasks, such as fake news detection.
All methods are equally robust to random perturbations (just as image classiﬁers typically are), suggesting that adversarial inputs reside in very speciﬁc directions off the manifold of normal samples.
4. H UMAN E VALUATION
[Table]
We veriﬁed the quality and the coherence of our examples via human experiments on Amazon Mechanical Turk.
First, we subsampled a 100 random test set examples and asked human evaluators to assign labels (e.g. positive or negative review) to both the original data points, and their adversarially altered versions.
We averaged the opinions of ﬁve different evaluations for each query.
We found that human evaluators achieved similar accuracies on both types of inputs, suggesting that our adversarial alterations preserved key semantics sufﬁciently well to be recognized by a human.
Human accuracy generally falls below that of the algorithms: the fake news task is inherently difﬁcult, while non-spam email is often misclassiﬁed since there is no standard deﬁnition for “ham” emails; on sentiment analysis, both accuracies are within a reasonable margin of error.
Next, we asked human annotators to rate the “writing quality” of the same set of examples on a scale of one to ﬁve, with ﬁve being the highest possible quality and likely generated by a human, and one being the lowest quality, likely generated by a machine.
Table 5 shows that humans tend to assign similar scores to both sets of samples.
Although our adversarial examples were not perfectly formed, these results suggest that they were of comparable quality to the original examples (which also contained multiple spelling and grammar errors).
4. E RROR A NALYSIS
[Table]
We found that our adversarial examples exhibit three kinds of errors: syntactic, semantic, and factual.
Syntactic errors are ungrammatical word substitutions; these include replacing ”isis claim responsibility for shooting” with ”isis petition responsibility for shooting” and ”never before has an fbi director” to ”never until has an fbi director”; the ﬁrst error is due to multiple word meanings, while the latter is due to the words being unrelated (and far in word vector space).
Semantic errors arise when the meaning of a sentence is altered.
Most often, this is due to multiple word senses — e.g., ”isis claim responsibility for shooting” to ”isis claim responsibility for ﬁlming” — or due to word embedding errors — e.g., ”isis claim responsibility for ceaseﬁre”.
Factual errors are a special case when the sentence becomes obviously false, e.g. when chainging ”Monday, March 16” changed to ”Thursday, March 16”, or ”FBI assistant director james kallstrom” to ”Pentagon assistant director james kallstrom”, or ”republicans backing Trump” to ”republicans backing Obama”.
These may not be an issue with fake reviews or fake news, and may be remedied via specialized techniques, e.g. by performing Named Entity Recognition.
4. T RANSFERABILITY
[Table]
An intriguing property of image classiﬁcation models is that adversarial examples generated for one classiﬁer are likely to be misclassiﬁed by ther classiﬁers.
We also examined whether adversarial texts transfer between the four models, focusing on the Yelp dataset.
As seen in
Table 6, there is a moderate degree of transferability between models.
Interestingly, adversarial examples for three word level models (NB,
LSTM, WCNN) do not generalize as well to the character level deep CNN as to other word level models, which suggests that the choice of input representation (character or word) is a factor that affects transferability.
4. E XPLAINING A DVERSARIAL E XAMPLES
We attribute the existence of adversarial examples to two factors, which we refer to as embeddingbased and representation-based.
A neural network classiﬁer for text contains two stages: ﬁrst, an embedding layer maps discrete words into continuous vectors; then, the embeddings are classiﬁed via convolutional or fully-connected layers.
Representation-based errors arise in the higher layers of the network; these layers are very similar to those of image classiﬁers and are therefore susceptible to the same types of attacks.
In other words, by replacing a word, we may adversarially push the embedding representation off the learned manifold into an adversarial region, causing a mislabel.
Representation-level adversarial perturbations have been studied by Miyato et al.
(2017) in the context of adversarial training,
and we observed them in our experiments as well.
On the other hand, embedding-based errors can be attributed to the inherently high dimensionality of the vocabulary, and can be studied by looking at linear classiﬁers.
For example, a perturbation for Naive Bayes implies that words which we consider equivalent (e.g., deﬁnitely and certainly) occur with different frequencies among the two classes.
This, in turn, can happen for two reasons: ﬁrstly, since the vocabulary is large, such words will arise due to statistical noise, unless the dataset is also very large; secondly, two words may truly have different conditional class probabilities, either because of multiple meanings (e.g., awfully great deal and awfully bad) or because of hidden patterns that we don’t understand (dogs are truly mentioned more often in spam than cats).
D ISCUSSION 5. A PPLICATIONS OF L ANGUAGE -B ASED A DVERSARIAL E XAMPLES
Our work demonstrates the existence of adversarial examples in state-of-the-art models for spam and sentiment classiﬁcation (the fake news state-of-the-art is not yet established).
The existence and transferability of such examples (obtained with very simple methods), hint at the existence of vulnerabilities in a number of systems; thes include text ﬁltering systems (e.g., spam, racism), online ranking algorithms, speech command processors, and others.
More generally, together with the work of Jia & Liang (2017), our observations lend further evidence to the prevalence of adversarial attacks in the natural language domain.
On the other hand, adversarial inputs can also improve algorithms via adversarial training (Shrivastava et al., 2016) by serving as extra data and thus increasing performance and robustness to adversarial attacks.
Miyato et al.
(2017) showed that adversarial perturbations to word embeddings are useful for semi-supervised learning; our ﬁndings hint at the possibility of adversarial training in the space of words.
5. C OMPARISON TO O THER D OMAINS
We found that adversarial examples are somewhat less abundant than in computer vision, especially on “easy” tasks such as spam classiﬁcation.
Interestingly, they affect linear models more; this smaller gap can be explained by the fact that text classiﬁcation models are relatively shallow and word inputs are in a sense “higher-level” than pixels: they are more susceptible to perturbations and leave less work to the rest of the network.
Although deﬁning a metric between utterance is nontrivial, it is also somewhat more forgiving: in many domains (such as spam) grammatical errors are common, and the meaning does not get lost (or seem unnatural) with errors.
Finally, it’s interesting to note that language-based problems have more direct access to the system being attacked; adversarial images are typically processed by real-world sensors, which affects their strength Kurakin et al.
(2016); language-based examples are fed into the system directly, which could make them more potent.
5. F UTURE W ORK
Our results demonstrate the existence of natural-language adversarial perturbations.
However, our simple perturbations could be improved via a more sophisticated algorithm that takes advantage of language processing technologies, such as syntactic parsing, named entity recognition, or paraphrasing, or that could be assisted by humans.
Furthermore, the existing search procedure naturally generalizes to beam search, and could modify phrases rather than words.
Interesting extensions apply to character-based substitutions, targeting both word- and character-based systems.
C ONCLUSION
We generalize the concept of adversarial examples to natural language classiﬁcation by proposing a simple yet effective similarity metric for text.
Then evaluate our approach on several classiﬁcation tasks and show that a simple greedy algorithm is effective at ﬁnding adversarial examples in each setting.
The presence of adversarial examples for text classiﬁcation poses threat to real-world machine learning systems.
We further study of adversarial examples for text classiﬁcation with help defend these systems and improve the accuracy of classiﬁcation algorithms via adversarial training.
A A PPENDIX
We include multiple examples of adversarially perturbed inputs in this appendix.
We provide examples for each model and each task.
Classiﬁer
[Table]
[Table] [Table]
Text: i ordered a carne asada burrito and it was garbage junk !
the carne asada tasted bad , thin and hard , just bad quality .
roberto enrico ’s is not that great
but it ’s better than this place
Classiﬁer: LSTM.
Original label: 97% Negative.
New label: 0% Negative.
Text: this that place location is far from the the best pho experience i ’ve ever had ( that is almost a bad pun ) .
it ’s really not bad , but there are much better vietnamese restaurants in vegas .
the pho broth is n’t on the same level as pho so 1 or lemongrass cafe .
for some reason , they were out of bean sprouts sprout and while i do n’t love them , i ’ve become accustomed to having them in my pho .
ﬁnally , i was a little disappointed that they do n’t serve tripe in any of their pho variations .
overall , although i did enjoy the soup , i probably wo n’t return .
i need to try the jenni jenny pho place just down the street .
if that does n’t work out , i ’ll just have to make the extra drive to chinatown .
[Table]
Text: give this place location 2 stars because of the new car buying experience .
i have always owned possessed an acura and never really encountered problems with buying a new car .
i was referred to a salesman chip , who by the way is amazing ! ! !
he was n’t there at the time and i wanted to purchase a brand new car , so i saw the next salesman named steve craig w. he was just as amazing as chip .
he worked with us throughout our process and was incredibly patient with us .
at the end of our car buying , we had a bump in the road and had a huge misunderstanding about the price of the car .
steve w. remained retained professional and patient with us .
when the sales manager , chris kyle b. came out , he was n’t happy with us .
he was a tad bit short tempered with us and made us feel like crap .
it ruined my experience with buying a car with acura , which is probably the reason why i am looking in henderson or california to buy ( has a much more competitive price as well
Classiﬁer: VDCNN.
Original label: 94% Negative.
New label: 8% Negative.
Text: i wanted want to love you spicy pickle , but it was your pickle dill i liked enjoyed best .
i had the bandito panini gorgonzola with peppered turkey , pepperjack , roasted red peppers , sundried tomatoes , chipotle mayo .
i took the sandwich to go and by the time i got to eat , it was pretty soggy .
the blend of ﬂavors did n’t save it .
i ’ll have to give it a second chance and dine in , maybe try a specialty sandwich instead equally .
Classiﬁer: LSTM.
Original label: 97% Negative.
New label: 0% Negative.
Text: long lines but amazing surprising burger cheeseburger and fries chips as always consistently .
i always get the double double and the fries nuggets animal style .
you can not go wrong with that .
manager was super sweet sugary and nice good
Classiﬁer: Naive Bayes
[Table] Original [Table] Spam
[Table] % Spam.
Text: wondercum is a wonderful combination of ﬁne herbs weed extract that are well known for centuries we do not have any branched or stores storing located anywhere whenever .
http : oov
Classiﬁer: LSTM.
Original [Table] 73% Spam.
New [Table] 0% Spam.
Text: view viewpoint pics images of christian protestant singles in your area realm meet cater christian protestant singles with oov values in your area realm .
oov this email mailroom is a commercial advertisement publicity sent forwarded in compliance with the oov act of 2003.
we have no desire volition to send you information that is not wanted , therefore similarly , if you wish to be excluded from future mailings , please use the link at the bottom of the page
Task: Spam [Table] Classiﬁer
[Table] WordCNN [Table]
Original [Table]
[Table]
Text: your loan borrower application apps is waiting hoping dear pricey homeowner landowner are you still paying too much for your current mortgage subprime ?
reﬁnaance us best [Table] cadence
[Table] approval ratiﬁcation is waiting expecting [Table]
please respond
[Table]
http
[Table]
helen [Table] gay lendingtree department administration [Table]
NB
[Table]
Text: urgent : your paypal account has expired !
paypal body , td protect your account ¡oov¿ sure you never provide your password to fraudulent bogus websites .
for more information on protecting yourself from fraud , please review our security tips at https : ¡oov¿ your ¡oov¿ should never give your paypal password to anyone , including paypal employees gov . upgrade your information dear member lawmakers , it has come to our attention that your paypal billing legislation information is out of date .
therefore we have had to put a limit your paypal account .
we require you to update your billing legislation information on or before 4th june 2007.
failure to update your records may result in a suspension of your account .
to update your paypal billing invoices information click the link below , login to your account with your email address and password and read the on screen instructions : http : //www.paypal.com/cgi-bin/webscr ?
¡oov¿ this security measure helps us continue to offer paypal as a secure and cost-effective payment service .
we appreciate your cooperation and assistance .
sincerely , the paypal team please do not reply to this email .
this mailbox is not monitored oversight and you will not