Phrase-level Textual Adversarial Attack with Label Preservation
Abstract
Generating high-quality textual adversarial examples is critical for investigating the pitfalls of natural language processing (NLP) models and further promoting their robustness.
Existing attacks are usually realized through word-level or sentence-level perturbations, which either limit the perturbation space or sacrifice fluency and textual quality, both affecting the attack effectiveness.
In this paper, we propose P hraseL evel Textual A dversarial A T tack (PLAT) that generates adversarial samples through phraselevel perturbations.
PLAT first extracts the vulnerable phrases as attack targets by a syntactic parser, and then perturbs them by a pre-trained blank-infilling model.
Such flexible perturbation design substantially expands the search space for more effective attacks without introducing too many modifications, and meanwhile maintaining the textual fluency and grammaticality via contextualized generation using surrounding texts.
Moreover, we develop a labelpreservation filter leveraging the likelihoods of language models fine-tuned on each class, rather than textual similarity, to rule out those perturbations that potentially alter the original class label for humans.
Extensive experiments and human evaluation demonstrate that PLAT has a superior attack effectiveness as well as a better label consistency than strong baselines.
Introduction
Despite the widespread success of deep learning in natural language processing (NLP) applications, a variety of works (Wallace et al., 2019;
Jia et al., 2019; Cheng et al., 2019) discovered that neural networks can be easily fooled to produce incorrect predictions, when their input text is modified by adversarial attacks that do not necessarily alter human predictions and the true meaning of the original text.
Through the lens of adversarial attacks, we can allocate the weakness of models and in turn
Flat Iron Steak was prepared very well .
Good chain restaurant with predictably good service …
Flat Iron Steak was { very good, excellent, fresh and delicious, ... } .
Good chain restaurant with { a great deal of, lots of, consistently, ... } good service …
Original Text
Adversarial Text
Extract phrases, then attack with phrase-level perturbations
Positive!
Negative! improve their reliability and robustness (Jia and
Liang, 2017; Belinkov and Bisk, 2018).
However, generating high-quality adversarial texts is nontrivial due to the discrete nature of human language and its rigorous linguistic structures.
While many efforts of previous works have been taken to generate word-level perturbations (Ren et al., 2019; Alzantot et al., 2018; Jin et al., 2020;
Li et al., 2020; Garg and Ramakrishnan, 2020; Li et al., 2021) for the sake of simplicity, their attacks are restricted to independent perturbations on single words and thus cannot produce richer and more diverse forms of adversarial examples.
To expand the search space for attacks, sentence-level attacks have been explored (Iyyer et al., 2018; Wang et al., 2020b,a; Qi et al., 2021) such as using paraphrasing, but their textual quality is usually poor due to insufficient constraints or controls on the structure and meanings of the generated texts.
To generate controllable high-quality textual adversarial examples, we propose a new phrase-level attack, PLAT, which can explore more diverse and flexible forms of perturbations than single word perturbations.
Our model is able to produce phraselevel perturbations with a high success rate and preserve the textual similarity in a more controllable manner.
As illustrated in Figure 1, with the help of constituency parsing, PLAT first detects and extracts the most vulnerable phrases from the text to the victim model as the attack targets.
To maintain textual fluency and grammaticality, PLAT perturbs these phrases through a contextualized blank-infilling procedure by a pre-trained language model.
Compared to existing textual adversarial attacks, PLAT can produce more effective attacks by searching in a larger space of phrase-level perturbation.
Meanwhile, PLAT delicately controls the range and amount of modifications so the textual meaning of the original texts will not be altered significantly after attacks.
Moreover, the success of attacks can be trivial if allowed to arbitrarily distort the ground-truth label or key contents.
Hence, a valid attack is required to not change the ground-truth label predicted by humans.
However, the semantic similarity filters widely used in existing works to guarantee the validity of adversarial samples (Jin et al., 2020; Li et al., 2020) perform unsatisfactorily, especially in preserving the textual meaning and even flip the gold labels according to a recent study (Morris et al., 2020).
To this end, we develop a label-preservation filter to maintain class-dependent properties such as sentiments.
It is built upon the comparison of likelihoods of language models fine-tuned on different classes’ data.
Thereby, it selects the attacks that can easily fool the victim model but possibly hardly alter the original labels.
Our contributions in this paper are three-fold:
• We propose a phrase-level textual adversarial attack that employs contextualized blank-infilling to generate high-quality phrase perturbations.
It expands the perturbation space of word-level attacks and thus can produce more effective attacks without notably hurting the fluency and grammaticality.
• We introduce a novel label-preservation filter, which utilizes the likelihood of class-specific language model to generate more reliable adversarial examples.
• Extensive experiments demonstrate the effectiveness of PLAT on multiple text classification and natural language inference tasks, hence presenting a new robustness challenge to existing NLP models.
Methodology
In this section, we first formulate the problem of phrase-level textual adversarial attack.
Then we elaborate on how PLAT chooses phrase candidates to attack and how to adversarially perturb them.
Finally, we discuss strategies to select the most effective perturbations with label preservation.
2. Problem Definition
We focus on generating textual adversarial examples for classification tasks.
Given a textual sequence x = x 1 x 2 . . .
x n with a specific attribute label y and a victim model F (assume F ( x ) =
y ) to attack, our goal is to generate an adversarial sample x ′ by perturbing x .
A valid adversarial example x ′ can successfully trigger a wrong prediction of the victim model, i.e. F ( x ′ ) ̸
= y , while the human judgement on x ′ should stay unaltered as y .
To achieve this goal, x ′ needs to be sufficiently similar to x with reasonable fluency and correct grammaticality.
2. Phrase-level Attack Phrase candidates.
Given a sequence x , PLAT allocates candidates of phrases to attack from the syntactic tree extracted by a language parser (e.g.,
Stanford Parser (Manning et al., 2014), etc.).
The model first traverses all constituents (nodes) in the syntactic tree in a top-down manner.
If a node is identified as a phrase, i.e. tagged as NP , VP , etc., the text piece in x associated with all nodes in the subtree that is rooted at the current node, will be regarded as an attacking candidate.
For more controllable attacks, we set a maximum depth of syntactic subtree d to restrict the length of candidate phrases so the modification to x is limited, hence resulting in more possibly valid adversarial samples.
Thereby, we obtain a set of multiple candidate phrases in the form of A
=
{ ( a , i, j ) } , where i and j are the indices of the leftest and rightest token of a phrase a from x .
Phrase importance.
To produce attacks more effectively against the victim model F (e.g., fine-tuned BERT (Devlin et al., 2019)), PLAT only perturbs the phrase candidates important to the prediction as former works (Jin et al., 2020; Ren et al., 2019).
Specifically, we consider to replace a phrase { ( a , i, j ) } in x with a series of special symbol [MASK] 2 with the same length as a , which results in ˜ x
= x 1 . . .
x i − 1 , [MASK] . . .
[MASK] , x j +1 . . .
x n .
The importance for phrase a is measured by
I ( a ) =
P F ( y | x ) − P F ( y | ˜ x ) , where P F ( y |· ) is the probability of the ground truth label y predicted by F given the input textual sequence.
Larger I ( a ) indicates that the phrase a has more significant contribution to the prediction of y .
PLAT manipulates each target phrase in candidate sets A by following a descending order of their importance scores.
So more effective phraselevel perturbations are applied earlier for achieving minimum modifications to x .
Phrase perturbations.
To generate phrase-level adversarial perturbations, PLAT performs a blankinfilling procedure on each target phrase.
Specifically, PLAT first replaces a target phrase a ∈ A with a blank (a single special [MASK] token in our implementation) from index i to j , i.e., ˜ x \ a = x 1 , . . .
, x i − 1 , , x j +1 , . . .
, x n .
Then a pre-trained blank-infilling language model, e.g., BART (Lewis et al., 2020) or T5 (Raffel et al., 2020), takes ˜ x \ a as the input and fills a phrase b =
z 1 . . .
z m having m tokens into the blank conditioned on surrounding context, i.e., ˜ x b = x 1 . . .
x i − 1 , z 1 . . .
z m , x j +1 . . .
x n .
In contrast to paraphrasing each phrase independently, such contextualized infilling procedure can produce more fluent and grammatically correct perturbations fitting into the rest context.
For attacking each target phrase, PLAT samples N candidates of perturbed phrases B = { b } with varying lengths.
During the generation, PLAT tends to sample tokens of higher probability at every step so that the outputs are more appropriate with the surrounding context.
In addition, we keep the maximum length of perturbations not greater than the length of original phrases plus a threshold l (e.g., | b | ≤ | a | + l ).
The most effective perturbation in B is then selected to replace the target phrase a , resulting in a perturbed text
˜ x b (The details of selection will be discussed in §2.3).
We apply the above phrase perturbation sequentially to all target phrases from A 3 until (1) a valid
1: Input: Original text x , the gold label y , victim model F , maximum number of perturbation
T , importance score I , likelihood ratio threshold δ .
Two filter functions: class-conditioned likelihood function R ( · ) , effectiveness score function S ( · ) 2: Output: An adversarial example x ′ 3: Extract phrase candidates from x to form the set
A 4: x (0) ← x 5: for 1 ≤ t ≤ T do 6: a ← target phrase with highest I in A 7:
B ← a set of phrases perturbations generated by blank-infilling ˜ x
( t − 1) \ a 8:
B ← filtering B by R ( x ( t − 1) , b ′ , y ) <
δ 9: if B = ∅ then x ( t ) =
x ( t − 1) , continue 10: end if 11: b ← argmax b ′ ∈B
S ( x ( t − 1) , b ′ ) 12: x ( t ) ← ˜ x ( t − 1) b (replace a with b in x ( t − 1) ) 13: if F ( x ( t ) )
̸
=
y then return x ( t ) 14: end if 15: end for 16: return N ONE adversarial sample x
( t ) is found when perturbing the t th target phrase,
i.e., F ( x ( t ) ) ̸
= y ; or (2) the maximum number of perturbations T is reached.
We summarize the above procedure in Algorithm 1.
2. Label Preservation and Effective Perturbation. Label preservation filter.
Although existing works (Jin et al., 2020; Chen et al., 2021) usually employ a semantic similarity constraint (e.g.,
USE (Cer et al., 2018)) to encourage the validity of adversarial samples, it has been observed that such constraint is unreliable to preserve the textual meaning (Morris et al., 2020).
Moreover, existing approaches rarely preserve class-dependent contents, e.g., sentiments, and might produce invalid adversarial examples with human-annotated labels flipped.
Such a drawback is commonly observed in our human evaluation in §3.3.
In order to retain the class-related characteristics most critical to classification tasks, inspired by Malmi et al., 2020, PLAT directly filters phrase perturbations using likelihoods provided by class-conditioned masked language models (CMLMs).
Specifically, given a sequence ˜ x b = x 1 , . . .
, x i − 1 , z 1 , . . .
, z m , x j +1 , . . .
, x n , the classconditioned likelihood of the adversarially perturbed phrase b = z 1 , . .
. , z m for phrase ( a , i, j ) in x can be calculated as
[Equation]
Here, m is the length of b , ˜ x
b \ z k is the perturbed sequence ˜ x b with token
z k masked, P CMLM is the likelihood of z k given ˜ x b \ z k , which is produced by a class-conditioned masked language model Θ y conditioned on class y .
The conditional language model is first initialized as a pre-trained model and then fine-tuned with the pre-training objective on the data from the dataset that belonging to the class y .
Therefore, a larger likelihood indicates that b is more likely to match the corresponding class distribution given the surrounding context.
To avoid label flipping of human prediction, the phrase perturbations should enjoy a higher likelihood on the original class’s distribution but a lower likelihood on other classes.
This property can be measured by the following likelihood ratio:
[Equation]
where Y denotes the set of all classes in the task.
A higher likelihood ratio suggests the perturbation is more correlated to the original label in contrast to other labels.
For better label preservation, the committed phrase perturbations are required to have a likelihood ratio larger than certain threshold δ , i.e. R ( x , b , y ) ≥ δ for b ∈ B .
As shown in §3.3, our method outperforms other baselines on labelpreservation according to human evaluation.
Selection of the most effective perturbation.
To generate x ′ with sufficient global textual-similarity to x , PLAT selects target phrases with syntactic tree depth no deeper than d and restricts their perturbations’ lengths to be no larger than their length by l .
Moreover, PLAT aims at utilizing minimum perturbations to perform effective adversarial attacks, so the textual similarity can be preserved.
Minimum perturbations can in return help maintain reasonable fluency and grammaticality of the generated texts.
To achieve the above goals, PLAT selects the most effective phrase perturbation at each step as the one that minimizes the probability of the gold label y predicted by F .
We use a score to measure each phrase b in terms of how likely it can successfully fool the model, i.e. the negative probability of the gold label y for the original x associated with the perturbation b , i.e.,
[Equation]
When attacking a target phrase, PLAT only chooses one phrase perturbation b ∈ B with the highest score.
The resulted perturbed-sequence is retained and then used as the initial sequence for the next time of perturbation.
2. Discussion
A primary novelty of PLAT is the phrase-level perturbation.
Compared to the widely studied wordlevel perturbations (Ren et al., 2019; Jin et al., 2020;
Li et al., 2021) that can only independently perturb a single word every time, PLAT can perturb a text span of varying lengths by replacing it with phrases of possibly unequal lengths.
Hence, it produces a more flexible attack by searching it in a larger perturbation space.
Although the textual phraselevel attack has been studied by a concurrent work
MAYA (Chen et al., 2021), there are several critical differences of PLAT, i.e., (1) The phrase-level attack by PLAT is a more general attack model that covers both word-level and phrase-level perturbations in one framework, while
MAYA builds separate sub-modules for different levels of perturbations
(2) PLAT adopts a blank-infilling strategy and leverages language models to generate phrase perturbations in a context-aware manner, leading to more fluent and grammatical adversarial examples.
On the contrary, MAYA applies paraphrasing to each constituent target separately without taking its surrounding context information into account.
(3) PLAT applies several constraints and filters to the phrase perturbations for more controllable attacks and better preservation of the original textual and label information, while MAYA has no such restrictions and its generated perturbations can introduce arbitrary distortions to the original text.
Experiments
In this section, we first elaborate on the experimental settings and implementation details of PLAT as well as the comparisons to several baselines in §3.1.
We then introduce the datasets and evaluation designs in §3.2.
At the end, we summarize the main results in §3.3.
3. Setup
The implementation details are given as follows:
• We use pre-trained BART base (Lewis et al., 2020) as the language model for blank-infilling to generate phrase perturbations.
We sample N =candidates as the phrase set B via Top-K sampling (Fan et al., 2018), while set restriction d = 4 , l = 3 for each target phrase.
In sections §4.1, we also report the performance comparison when using different language models.
• We use a RoBERTa base (Liu et al., 2019) to calculate the class-conditioned likelihood for labelpreserving filters.
On each dataset, the model is further fine-tuned to optimize the masked language modeling pre-training objective on each sequence with a prepending special label token indicating the current class.
We set threshold δ = 1 for the filtering.
• The victim model F is an MLP classifier based on a BERT base model (Devlin et al., 2019).
It takes the representation of [CLS] token for prediction and is fine-tuned on the target datasets in advance.
Baselines.
We compare PLAT with four state-ofthe-art textual adversarial attack models:• Textfooler (Jin et al., 2020): a word-level attack model, which replaces tokens with their synonyms via counter-fitting word embeddings (Mrkši´c et al., 2016).
USE (Cer et al., 2018) distance is used to select adversarial texts that can mostly preserve the semantic similarity.
• CLARE (Li et al., 2021): instead of token replacement only, CLARE considers three wordlevel perturbations: replacement, insertion, and merging.
Pre-trained masked language models are used to generate perturbations and a USE semantic similarity filter is applied.
• MAYA (Chen et al., 2021): a multi-granularity model that attacks the input using two separate modules for word replacement and constituent paraphrasing.
It employs the embedding of SentenceBERT (Reimers and Gurevych, 2019) for semantic similarity preservation.
StyleAdv (Qi et al., 2021): a sentence-level model based on text style transfer.
To launch an attack, it paraphrases the whole examples with five
[Table]
different
text styles: tweets, bible, poetry, shaekspeare and lyrics.
3. Datasets and Evaluation Datasets.
We investigate the following datasets for text classification and natural language inference tasks in our experiments.
The statistics and performance of the victim models evaluated on each dataset are reported in Table 1.
• Yelp Reviews (Zhang et al., 2015): a binary sentiment classification dataset containing restaurant reviews as samples.
• AG News (Zhang et al., 2015): a news articles classification dataset covering four classes: World , Sport , Business , and Science and Technology .
• MNLI (Williams et al., 2018): a natural language inference dataset, where each sample contains a pair of sentences whose relationship is labeled as entailment , neutral , or contradiction .
We use the matched test set here.
• QNLI (Wang et al., 2018): a natural language inference dataset based on the question answering corpus SQuAD (Rajpurkar et al., 2016).
Each sample contains a context and a question labeled as entailed or not entailed .
All attacks will be conducted on 1000 instances randomly drawn from test sets.
For tasks on a pair of sentences, we attack the longer sentence.
Evaluation metrics.
We evaluate models using the following automatic metrics:
• Attack success rate (ASR) : the percentage of successful adversarial attacks that trigger wrong predictions of the victim model.
• Edit Distance (DIS) (Navarro, 2001): the normalized Levenshtein distance that measures the minimum amount of word edits required to transform the original text to the adversarial one.
It measures the modification rate of an adversarial sample.
• BLEU
(Papineni et al., 2002): the BLEU score between an adversarial sample and its corresponding original sample is used to measure their n-gram overlap (textual similarity).
We do not report the
Dataset
Yelp (PPL = 51.5)
AG News (PPL = 62.8)
Model
ASR ↑
DIS ↓
BLEU ↑
PPL ↓
GER ↓
ASR ↑
DIS ↓
BLEU ↑
PPL ↓
GER ↓
Textfooler 94.
1.43 CLARE 97.
MAYA 97.
4.30 StyleAdv 90.
PLAT 98.
Dataset
MNLI (PPL = 60.9)
QNLI (PPL = 46.0)
Model
ASR ↑
DIS ↓
BLEU ↑
PPL ↓
GER ↓
ASR ↑
DIS ↓
BLEU ↑
PPL ↓
GER ↓
Textfooler 58.
0.62 CLARE 86.
MAYA 92.
StyleAdv 72.
[Table]
BLEU scores of StyleAdv , as the BLEU scores are extremely low (on 3 of 4 tasks the BLEU scores are at the scale of 10 − 81 ).
• Perplexity (PPL) : a pre-trained GPT2 small (Radford et al., 2019) is used to calculate the PPL of adversarial texts, which reflects the fluency as suggested by (Kann et al., 2018; Zang et al., 2020a).
• Grammar error (GER) :
Following Zang et al., 2020b, we employ LanguageTool 6 to calculate the average number of grammar errors newly introduced by adversarial samples.
We only evaluate
the last four metrics
on the
successful attacks against the victim model.
3. Main Results
Table 2 summarizes the main experimental and comparison results.
Overall, PLAT consistently achieves a better attack success rate and perplexity performance across all datasets.
We attribute this to the flexible phrase-level perturbations generated using contextual information.
PLAT achieves a significantly better text quality than the sentence-level model StyleAttack, in terms of modificaton rates,
BLEU, and perplexity.
Compared with a phraselevel model MAYA, our method is significantly better on modification rates, BLEU, and grammar scores.
Hence, despite not using semantic similarity constraints, PLAT is more controllable than
MAYA as we confine the modification ranges and generate perturbations by contextual blank-infilling.
While word-level attacks naturally introduce fewer
[Table]
perturbations and thus have better textual similarity and grammaticality, its perturbation space is small and results in lower success rates.
On the contrary,
PLAT achieves the highest success rate while on a par with word-level attacks on textual similarity and grammaticality, hence achieving a sweet spot among all metrics.
Human evaluation.
We further conduct human evaluations on Yelp dataset with 100 randomly selected successful attacks produced by PLAT,
CLARE, and MAYA.
We evaluate these attacks in three aspects: (1) Meaning preservation : whether the attacks preserve the original meaning or not; (2) Label preservation : whether the modifications contradict the original sentiment or not; (3) We evaluate fluency and grammaticality via pairwise comparison: for each instance, we pair PLAT’s attack with one by CLARE or MAYA.
The human annotators are asked to either select the better one or rate them as equal.
We average 6 responses for each sample.
More details are in Appendix D.
As shown in Table 3, PLAT significantly out-
[Table] [Table]
performs CLARE and MAYA in terms of label consistency, i.e., 77.1% vs. 49.8%(CLARE) or 53.5%(MAYA).
This demonstrates the benefit of our whole architecture that utilizes both phraselevel infilling and sufficient constraints.
It’s worth noting that all models struggle on preserving the textual meaning and less than 40% of samples can retain their original meaning.
This is consistent with Morris et al.
, 2020 in that semantic similarity metrics fail to maintain the actual meaning under most conditions.
On the fluency and grammaticality, PLAT is comparable to CLARE but is much better than MAYA (45% vs. 26%), since our context-aware blank-infilling is superior to paraphrasing each text piece independently.
Finally,
Table 4 compares adversarial attacks crafted by our model and other baselines.
More case studies are provided in Appendix B.
Vulnerable phrase types.
We also analyze the three mostly attacked phrase types on each dataset.
As shown in Table 5, noun phrases (NP) are the most vulnerable phrases over all datasets (more than 50% on three datasets), while preposition phrases (PP) and proper noun phrases (NNP) are also commonly vulnerable.
Analysis
In this section, we conduct detailed analyses of
PLAT, including ablation study (§4.1), discussion of controllability in blank infilling (§4.2), and attacking robust defense models (§4.3).
[Table]
4. Ablation Study
We evaluate the effectiveness of each key component in PLAT based on the 1,000 random Yelp samples §3.2.
We first study the phrase-level perturbation by replacing it with the word-level replacement used in Textfooler ( w/o PHRASE - LEVEL ).
As Table 6 shows, phrase-level perturbation has a larger attack search space which leads to better attack success rate, perplexity and grammar score.
It also demonstrates that attacking the constituents that are labeled as phrases is more effective than attacking all possible constituents.
This is probably because phrases contain more critical and clear information to attack in classification tasks.
In addition, we have not observed a significant difference between using BERT base and
RoBERTa base for class-conditioned likelihood calculation, probably due to their similar architectures and shared knowledge.
Finally, we comparing different blank-infilling methods using pre-trained
BART base (PLAT), pre-trained T5 base (Raffel et al., 2020) and fine-tuned GPT-2 small (Donahue et al., 2020).
Empirically, BART base achieves the best overall performance.
Moreover, we investigate the effectiveness of the label-preservation filter in §C.
4. Sensitivity and Controllability Analysis
In this section, we investigate how the outputs can be controlled by hyper-parameters in PLAT on Yelp dataset.
We first study how the generated samples can be impacted by varying the candidate number
[Figure] [Figure]
N in blank-infilling.
As shown in Figure 2, the success rate ( ASR ) increases with the increase of
N but starts to saturate when N ≥ 500 , while the grammar errors ( GER ) stay quite consistent.
Meanwhile, the edit distance ( DIS ) drops significantly but the perplexity ( PPL ) only increases slightly when N increases.
Based on these observations, we choose N = 5000 in our experiments for the best trade-off among these aspects.
In addition
[Figure]
we explore how the syntactic tree depth d in target phrases and the incremental length l for perturbed phrases can affect the modification degree.
In Figure 3, with the increase of d or l , more modifications are introduced and the textual similarity decreases, which undermines the validity of adversarial samples, as larger d and l may augment the attacking space with longer but unnecessary perturbations.
Hence, we choose relatively small d and l to ensure the attack is more controllable.
Note that both d and l exhibit a slight impact on the success rate (Refer to Appendix C for detailed results).
4. Attacking Robust Defense Model
In this section, we examine whether existing robust defense models can defend PLAT attack which is beyond word-level perturbations.
We apply a robust BERT base defense model trained via
[Table]
TAVAT (Li and Qiu, 2021) to defend the attacks from PLAT and baseline models, which is designed for word-level attacks.
Comparing Table 7 with Table 2, both the edit distance and BLEU get worse when attacking the defense model, showing that the defense model is harder to attack.
Meanwhile, two word-level attacks have a significant attack success rate drop, e.g., 94.5% to 64.2% on TextFooler.
On the contrary, PLAT still can achieve the best 99.2% attack success rate with sufficient textual similarity and grammar errors, outperforming MAYA in every aspect.
This suggests that PLAT raises a new robustness issue on current defense models.
Related Work Textual Adversarial Attack
Growing interest is devoted to generating textual adversarial samples via perturbation at various levels.
Some
early works use misspelling tokens in characterlevel (Liang et al., 2018; Ebrahimi et al., 2018; Li et al., 2019), but they can be easily defended by spell checking tools (Pruthi et al., 2019; Zhou et al., 2019; Jones et al., 2020).
Recent mainstream of studies try to misguide models via word-level perturbations, e.g., synonym/semantic neighbor substitution (Alzantot et al., 2018; Jin et al., 2020;
Ren et al., 2019; Zhang et al., 2019), replacement by pre-trained masked language models (Li et al., 2020; Zhang et al., 2019), or combing replacement with operations like insertion and merging (Li et al., 2021).
These methods usually attempt to preserve the semantic similarity for better fluency and grammaticality, but their perturbations are limited to independent single words.
Sentence-level attacks have also been studied to generate new texts via paraphrasing or GANbased generation (Iyyer et al., 2018; Wang et al., 2020b; Zou et al., 2020; Wang et al., 2020a; Qi et al., 2021), but their drastic modifications on the text structure make it harder to maintain a satisfactory textual quality.
Very recently, phrase-level perturbations are considered in evaluating the performance of syntactic parsing (Zheng et al., 2020), or involved in a multi-granularity textual attack model MAYA (Chen et al., 2021).
Unlike MAYA,
PLAT only focuses on unified phrase-level attacks without multiple sub-modules, which require simpler and fewer modifications while benefiting better performance.
Blank Infilling
Large-scale pre-trained language models such as BERT (Devlin et al., 2019) and
RoBERTa (Liu et al., 2019) have shown their capability of filling masked single tokens (Wang and
Cho, 2019; Ghazvininejad et al., 2019) but they cannot handle variable-length masks.
Although autoregressive generative models such as GPT (Radford et al., 2018) or GPT2 (Radford et al., 2019) can produce outputs with arbitrary lengths, they only condition information from a single direction and ignore some surrounding texts.
To enable GPT models to fill in blanks, Donahue et al.
proposed to fine-tune them with sequences concatenating manually-masked texts and missing texts.
Recently, autoencoder-decoder models such as T5 (Raffel et al., 2020) and BART (Lewis et al., 2020), which are trained using text infilling losses make it possible to fill the blanks within the context in a more flexible form (Shen et al., 2020).
Conclusion
We present a new phrase-level textual adversarial attack, PLAT, which produces richer and higherquality phrase-level perturbations than the widely studied word-level attacks.
It utilizes contextualized blank-infilling to generate perturbations by a pre-trained language model and thus well preserves the fluency, and grammaticality.
We additionally develop a label-preservation filter based on the likelihood given by class-conditioned language models, trying to to keep the ground-truth labels intact.
Extensive experiments show the effectiveness of PLAT and its advantages over baselines on different NLP tasks.
A Implementation Details A. Details of PLAT Basic infrastructure
We use PyTorch as the backbone of our implementation, along with
Huggingface-Transformers 7 for the implementation of victim models and likelihood estimation models, while Fairseq for the implementation of blank-infilling model BART 8 .
We list the hyperparameters used in our model in Table 8, all of them are determined empirically based on both attack success rate and textual quality.
It takes aboutminutes to generate 100 adversarial samples on
Yelp dataset using PLAT on a single NVIDIA GTX 1080 Ti GPU.
Select phrase candidates.
We use the parser from Stanford CoreNLP 9 toolkit for the syntactic tree parsing.
We consider parsed nodes with the syntactic tags in Table 9 as the possible root node of a phrase.
[Table] [Table]
Blank filling with language model.
In our default setting, we directly apply the original
BART base model 10 with 6 encoder and decoder layers and 140M parameters.
During infilling, the target phrase a will be replaced with a special symbol “<mask>”, then the model will fill this blank with variable-length context.
The Top-K sampling strategy is used during generation, where we set k = 50 and repeat this procedure several times to collect enough phrase substitution candidates.
Since BART base implement blank filling via reconstructing the whole sentence, where the text excluding the blank part after filling may not be the same as the original one, we simply only reserve the reconstructed sentences which keep the text excluding the blank part unchanged.
In the variations with other blank-infilling models, we use GPT-2 small model 11 with 124M parameters or T5 base model 12 with 220M parameters, both have 12 layers.
Since the original GPT-2 small model is not suitable for blank infilling, we enable GPTmodel to implement this task by finetuing on Yelp training corpus using method proposed by Donahue et al., running the code provide by the authors 13 .
[Table]
Models for calculating likelihood.
We apply
RoBERTa base 14 model fine-tuned on the corresponding training set of each attack dataset in this stage, which has 12 layers and 125M parameter.
Then we fine-tune the label-conditioned masked language models on different datasets as follows to make them better fit the specific domain.
• Classification datasets (Yelp, AG News): Since each sample is usually long, we split a sample into several short sentences as the input for fine-tuning.
To avoid the conditions that some short sentences may be irrelevant or contradict the overall label y , we employ a classifier to make predictions on these sentences and only remain sentences with the confidence value of y higher than 0.99.
Such a sentence along with the special label token “ <Label> ” corresponding to the overall label y will form a new sample for fine-tuning, whose input format is “ <Label> Sentence ”.
• NLI datasets (MNLI, QNLI): samples in these datasets are usually a pair of short sentences, so we will not split them.
The input format for these datasets is “ <Label> SentenceA 
 
 SentenceB ”, where “ 

 ” is the separation symbol in RoBERTa.
11 https://huggingface.co/gpt2https://huggingface.co/t5-basehttps://github.com/chrisdonahue/ilmhttps://huggingface.co/roberta-base
Then we will randomly mask some tokens in these samples to fine-tune a masked language model conditioned on labels, the batch size is 8, and the learning rate is 5 e − 5 with AdamW optimizer.
The PPL before and after fine-tuning is shown in Table 10, demonstrating the effectiveness of this procedure.
When predicting the likelihood of a perturbation, we will concatenate the label of the original sample with the masked perturbed sequence as the input, similar to samples in fine-tuning.
When attacking
Yelp and AG News datasets, we also only use the sub-sentence containing the perturbation, rather than the whole text.
Metrics.
To obtain the edit distance (DIS) metric, we utilize the open-source tool 15 to calculate it in token-level, i.e. how many words need to be edited to transform a text into another one and then normalized by the text length.
In addition, we employ
Toolkit in NLTK 16 to calculate BLEU metrics between adversarial samples and the corresponding original samples.
A. Details of Victim Models
BERT models.
All BERT victim models are based on BERT base17 , which contains 110M parameters with 12 layers.
A linear layer is added for classification, which takes the representation of “[CLS]” token in the head of a sequence as the input.
We then fine-tune victim models on each dataset using batch size 32 and the learning rate 2 e − 5 for 3 epochs.
The final model after 3 epochs will be saved and used as the victim model F on each dataset.
Train robust models using TAVAT.
The robust models are also based on BERT base with a linear layer added for classification.
We fine-tune the model using an adversarial training method TAVAT proposed by Li and Qiu which is a token-level gradient accumulation of perturbations, by running code provided by the authors 18 with all default hyper-parameters.
During finetuning, perturbations guided by gradient are applied to the embedding space and models are trained using these perturbed data.
A. Details of baseline MAYA
MAYA has three variants: MAYA, MAYA π and
MAYA bt .
We select MAYA as our baseline since overall it obtains the best attack success rate and perplexity performance.
A. Possible Limitations of Our Model
The label-preservation filter in our PLAT model utilizes label-conditioned masked language models, which need to be fine-tuned on a labeled corpus with sufficient data.
Therefore, the performance of PLAT may drop on datasets that have limited number of labeled samples.
In addition, it takes about 1 minute for our model to generate one adversarial sample using BERT as the victim model, so PLAT is not applicable for conditions with low computational resources.
B Additional Qualitative Samples
We introduce some additional adversarial samples generated by our PLAT model, along with three baselines, TextFooler, CLARE, MAYA, on four datasets, Yelp, AG News, MNLI, QNLI, in Table 11, Table 12, and Table 13.
[Table]
I had nothing but fun at this out of the way place.
Portions very large
[Table]
fresh
[Table]
I want to try everything on the
[Table]
was also delicious
[Table]
friendly servers
[Table]
I love this place.
I love everything there except the kabsa rice but that’s just me.
Burgers are good.
They pile on the veggies.
Owner is nice.
Freshly made food always has my mouth watering .
TextFooler
[Table]
I aime this place.
I love everything there except the kabsa rice but that’s just me.
Burgers are good.
They pile on the veggies.
Owner is nice.
Freshly made food always has my mouth watering.
[Table]
I hate this place.
I love everything there except the kabsa rice but that’s just me.
Burgers are good.
They pile on the veggies.
Owner is nice.
Freshly made food always has my mouth watering.
[Table]
I know this place.
I love everything there except the kabsa rice but that’s just me.
Burgers are good.
They pile on the veggies.
Owner is nice.
Freshly made food always has my mouth watering.
[Table]
I can’t recommend Aptopia enough.
I love everything there except the kabsa rice but that’s just me.
Burgers are good.
They pile on the veggies.
Owner is nice.
Freshly made food always has my mouth watering.
[Table]
Scientists Discover Ganymede has a Lumpy Interior.
Jet Propulsion Lab–Scientists have discov- ered irregular lumps beneath the icy surface of Jupiter’s largest moon, Ganymede.
These irregular masses may be rock formations, supported by Ganymede’s icy shell for billions of years...
[Table]
Researchers Unmask Deimos has a Lumpy Indoors.
Jet Rotor Laboratories–Searchers have discovered irregular clods into the icy surface of Juniper’s largest moon, Jupiter.
These irregular masses maggio be rock formations, contributions by Enceladus’s icy shell for billions of years...
[Table]
Scientists Know Ganymede has a Lumpy Interior.
Credit Jet Propulsion Lab–Featured Scientists have discovered irregular lumps beneath the icy surface of Jupiter’s largest moon, Ganymede.
These irregular masses may be rock formations, supported by Ganymede’s icy shell for billions of years...
[Table]
Scientists Discover Ganymed has a Lumpy Interior.
Scientists have discovered irregular lumps under the icy surface of jupiter’s largest moon..
These irregular masses may be rock formations, supported by ganymede’s icy shell for billions of years...
[Table]
Scientists Discover Ganymede has a Lumpy Interior.
JPL-Caltech STOCKHOLM–Scientists have discovered irregular lumps beneath the icy surface of Jupiter’s largest moon, Ganymede.
These irregular masses may be rock formations, supported by Ganymede’s icy shell for billions of years...
[Table]
Giddy Phelps Touches Gold for First Time.
Michael Phelps won the gold medal in the 400 individual medley and set a world record in a time of 4 minutes 8.
26 seconds.
[Table]
Dazzled Phelps Hits Gold for Premiere Time.
Michael Phelps won the gold trophy in the 400 personal medley and set a world record in a hours of 4 record 8.
26 seconds.
[Table]
Giddy Phelps Touches Gold for First Time.
Michael Phelps won the gold medal in the
[Table]
[Table] [Table]
the
[Table]
Hypothesis These routes typically follow mountain ranges or coastlines, sometimes rivers, and may take advantage of updrafts and other wind patterns or avoid geographical barriers such as large stretches of open water
[Table]
Premise What to the migrating birds usually follow?
Hypothesis These routes seldom follow colina telemetry or coastlines, sometimes rivers, and may take advantage of updrafts and other wind diagrams or avoid spatial separating such as large stretches of commencement water.
[Table]
Premise What to the migrating birds usually follow?
Hypothesis These routes cannot follow continental ranges or coastlines, connect rivers, and may take advantage of updrafts and other wind patterns or avoid geographical barriers such as large stretches
[Table]
C Additional Results C. Effectiveness of Label-Preservation Filter
Since human evaluation on ablation study of the label-preservation filter is costly, to verify its effect, we turn to use adversarial samples derived from the attack on the Yelp dataset.
Here, we train models with either only adversarial examples or a combination of original and adversarial examples to evaluate the label correctness of adversarial samples.
Since the labels of the Yelp test set are carefully annotated, the accuracy on the Yelp test set of each trained classifier can be regarded as a metric to reflect the label-preservation capability of the crafted adversarial examples.
A better label-preservation of adversarial samples will introduce less noise during training and thus results in preferable performance on the test set.
According to the results shown in Table 14, models trained using samples from our complete PLAT model with the label preservation filter shows higher accuracy than ones trained on samples derived from ablated
PLAT without such a filter, especially when only training the classifiers based on adversarial samples.
Therefore, it demonstrates that using the labelpreservation filter can obtain adversarial examples with better label consistency.
[Table]
C. Additional Results on Controllable Ability
We list the full results of §4.2 about controllable ability on Yelp dataset in Table 15, Table 16, and
Table 17, for the effects of candidate number N during infilling, syntactic tree depth restriction for phrase candidates d and length incremental restriction for substitution l on our PLAT model, respectively.
It can be found that all N , d , and l can control the performance of PLAT in different aspects.
Surprisingly, the grammar error decreases while d is increasing.
We attribute this to the fact that the modification range of the phrase is extended as d increases, such that the infilling text is less likely to be essentially conditioned on the surrounding context and fewer grammar errors occur at the boards between blanks and rest texts.
We also test the effects of different likelihood ratio threshold δ on Yelp dataset, which is illustrated in Figure 4.
A larger threshold δ may result in a lower attack success rate, more modifications
[Table]
and a worse textual quality.
[Table] [Table]
[Table]
D Details of Human Evaluation
We conducted our human evaluation via Google
Forms on a total 60 non-expert volunteer anno-
D I S
PP L
[Figure]
A S R 0.
B L E U 0.
G E R tators.
Each annotator was asked to rate forsets of examples, where each set contains one original sample and three corresponding adversarial samples generated by PLAT, CLARE, and MAYA respectively.
We show the screenshot of our instructions and examples in Figure 5, Figure 6, and
Figure 7, where the perturbed parts are in bold font.
We described how we would use these collected data in the invitations for annotators, and they must agree on this usage before evaluation.
All collected data go without personal information in our experiments.