ValCAT: Generating Variable-Length Contextualized Adversarial Transformations using Encoder-Decoder
Abstract
Adversarial texts help explore vulnerabilities in language models, improve model robustness, and explain their working mechanisms.
However, existing word-level attack methods trap in a one-to-one attack pattern, i.e., only a single word can be modified in one transformation round, such that they cannot perturb several consecutive words as a whole.
In this paper, we propose ValCAT , a black-box attack framework that misleads the language model by applying variable-length contextualized transformations to the original text.
Compared to wordlevel methods, ValCAT expands the basic unit of perturbation from single words to spans composed of multiple consecutive words, enhancing the perturbation capability.
Experiments show that our method outperforms state-of-theart methods in terms of attack success rate, perplexity, and semantic similarity on several classification tasks and inference tasks.
More comprehensive human evaluations demonstrate that
ValCAT has a significant advantage in ensuring the fluency of the adversarial samples and achieves better semantic consistency.
We release our code at https://github.com/ linerxliner/ValCAT .
Introduction
Deep learning is successfully applied in a variety of fields, while previous works have found that neural network models are vulnerable to well-constructed adversarial examples (Goodfellow et al., 2014; Kurakin et al., 2016).
In general, adversarial examples are data with imperceptible perturbations added to benign examples to mislead the target models.
Therefore, exploring adversarial examples is essential to improve the performance of neural network models with higher reliability and robustness.
However, compared to the long-studied image domain, generating adversarial examples on text is more difficult because texts are discrete, where small
[Table]
changes can alter the original meaning and make it unnatural (Xu et al., 2020; Zhang et al., 2020).
Most of the sentence-level attack methods (Zhao et al., 2018; Han et al., 2020; Xu et al., 2021) generate adversarial examples by perturbing the latent representation of the text, and the text quality is thus relatively difficult to control.
Word-level attack methods (Samanta and Mehta, 2017; Zhang et al., 2019a) have received much attention in the recent past.
Several previous works explore the perturbation based only on the properties of indi- 𝒙 (𝒙=𝒘 𝟏 𝒘 𝟐 …𝒘 𝒏 ) 𝑤 !
𝑤 " 𝑤 # 𝑤 # 𝑤 $ ...
𝑤 !
𝑤 " 𝑤 # 𝑤 % 𝑤 $ ...
(𝐼𝑛𝑑𝑒𝑥,𝐿𝑒𝑛𝑔𝑡ℎ,𝑆𝑐𝑜𝑟𝑒) : (𝐼 & ,𝐿 & ,𝑆 & ) (𝐼 ! ,𝐿 ! ,𝑆 ! )
(𝐼 " ,𝐿 " ,𝑆 " )
Rank Important Spans 𝑤 !
𝑤 " 𝑤 # 𝑤 # 𝑤 $ ...
𝑤 !
𝑤 ’ 𝑤 ’(!
𝑤 $ ... ...
Encoder
Decoder [𝑀𝐴𝑆𝐾] ... 𝑥 !,!
𝑥 !," 𝑥 !,# 𝑥 ",!
𝑥 #,!
𝑥 #," ......
𝑤 ’(" 𝑤 ’*!
Insert
Replace 𝑤 & 𝑥 !,!
𝑥 !," 𝑤 $ ... ...
𝑤 ’(" 𝑤 ’*!
𝑤 & 𝑥 ",!
𝑤 $ ... ...
𝑤 ’(" 𝑤 ’*!
𝑥 !,
# ...... 𝑤 !
𝑤 ’ 𝑤 ’(!
𝑤 $ ... ...
𝑤 ’*! 𝑦 !,!
𝑤 !
𝑤 ’ 𝑤 ’(!
𝑤 $ ... ...
𝑤 ’*! 𝑦 ",!
𝑦 ",! .....
[Figure]
Generate
[Figure] [Figure]
[Figure]
𝑤 ’(" 𝑤 ’*!
[Figure]
vidual words, with the help of inflectional morphology (Tan et al., 2020), counter-fitting word vectors (Jin et al., 2020), sememe (Zang et al., 2020), etc.
The encoder language models, like BERT, give us new insights of incorporating context information into the generation of transformation candidates (Li et al., 2020; Garg and Ramakrishnan, 2020; Li et al., 2021).
However, the basic attack units of all these works are still single words, which limits the scope of the perturbation and overlooks the interactions between words, as examples shown in Table 1.
To address this issue, two research questions are raised
: 1) How to take into account interactions between words in vulnerable position discovery?
2) How to perturb a vulnerable position with variablelength contextualized transformations?
We propose ValCAT, which generates highquality adversarial texts by applying variablelength
contextualized
transformations to the original text.
Table 1 demonstrates some sample cases.
Specifically, given a benign text, we enumerate all possible spans by traversing the text with sliding windows of different sizes and evaluate their importance.
We utilize two operations, Replace and
Insert , to apply adversarial spans generated by an encoder-decoder language model to the text.
The encoder can recover a mask token using a single word, while the decoder can predict the words after a prompt.
Therefore, joint use of encoder and decoder enables ValCAT to generate variable-length
contextualized
spans
at
arbitrary vulnerable posi-
tion
Furthermore, we evaluate ValCAT by attacking fine-tuned BERT on several classification tasks and inference tasks.
Experimental results show that it outperforms other baseline methods in attack success rate, perplexity, and semantic similarity.
In particular, we observe that the variable-length property can significantly reduce perplexity, which is less than 50% compared to the best baseline.
As for the efficiency, although each multi-word transformation perturbs more words than a single-word transformation, it requires fewer transformations toward success.
In general results, it is in a tolerable perturbation rate, which is even lower than baselines on some of the inference datasets.
A comprehensive human evaluation further verifies that ValCAT has significant advantages in fluency, grammaticality, and semantic similarity.
The main contributions of this paper are summarized as follows:
• We propose ValCAT, the first variable-length contextualized adversarial attack against language models.
• Our work is the first to propose a Sliding Window for vulnerable-position discovery and variablelength adversarial candidate generation, which fully exploits the advantage of encoder-decoder language models.
• Automatic evaluations and comprehensive human evaluations demonstrate the superior quality of our generated adversarial examples.
ValCAT
To further improve the attack effectiveness and simultaneously improve the fluency and semantic similarity of the adversarial samples, we propose
ValCAT , which can generate high-quality adversarial text by applying variable-length contextualized transformations with a encoder-decoder language model.
Problem Formalization
Given a victim model
[Equation]
and a text
[Equation]
that can be correctly classified by F , the attack goal is to generate an adversarial text ˜ x , which can confuse the model prediction, i.e. F (˜ x ) ̸ = F ( x ) .
A consecutive word sequence with length w can be denoted as a span s i : i + w .
In the soft-label blackbox setting, the attacker only has access to the logit output P ( y | x ) .
The architecture, parameters ,and configurations of F are unknown to the attacker.
To achieve human imperceptibility, the attacker should minimize textual perturbations and maintain semantic consistency.
ValCAT
The attack workflow of ValCAT is illustrated in Figure 1.
To locate the most-vulnerable positions for the perturbations in each iteration, ValCAT first rank the importance of s i : i + w in x with a sliding window of length 1 to MAX , as line 2-6 in
Algorithm 1.
Based on the sorted ranking list R ,
ValCAT uses the encoder-decoder language model to generate variable-length contextualized spans, as 8-13.
Using two transformation operations in line 9, R EPLACE and I NSERT , we obtain a adversarial text candidate set T .
If some of the candidates can mislead the victim model, ValCAT declares the one with the highest cosine similarity with the original text as the final successful result, as line 11.
However, if no candidate successes at this iteration, we select the one with the highest negative impact to the victim model as the basic text for the next iteration, as line 13.
Note that, if a span in the ranked list has been selected as the target span, the subsequent spans which are overlapped with the target span will be removed from the ranked list to avoid multiple modifications on a token.
The sequential attack ends when the successful attack occurs, or when the upper limit of the perturbation constraints (See Section 3.1) is reached.
The latter case is considered a final failure.
Below we elaborate on the two stages of the attack in Section 2.1 and Section 2.2, in detail.
2. Important Span Ranking
Echoing the observation to prior works (Jin et al., 2020; Li et al., 2020), only some key words act as most-vulnerable positions for the victim model
F .
Perturbations over these words can be most beneficial in crafting adversarial texts.
Considering the interactions between words, ValCAT performs transformations on several important spans instead of single words for each perturbation.
Given a text x , we evaluate the importance of a span s within x according to how removing the span can impact the model prediction in the blackbox setting.
Let
˜ x
s denote the text of replacing span s by a unknown token [unk] .
Formally, we define the differentiation of x and ˜ x s on the class y as:
D ( x
[Equation]
˜ x
[Equation] [Equation]
(cid:26) d
[Equation]
if y
[Equation]
y d y ( x
[Equation]
˜ x
[Equation]
+ d
[Equation] [Equation]
x
[Equation]
x )
[Equation]
if y ̸ = ˜ y where y and ˜ y are the predictions of x and ˜ x s , respectively, and d y ( x, ˜ x s ) = P ( y | x ) − P ( y | ˜ x s ) is the difference of the probabilities that x and ˜ x are classified as y .
The importance of s with respect to x is I x ( s ) =
D ( x, ˜ x s ) .
To compare spans of different lengths, we propose Sliding Windows to measure the importance of variable-length spans.
Specifically, we apply multiple sliding windows of the corresponding size, which traverse the text from left to right.
Each span bounded by a sliding window is sequentially removed from the original text for its importance calculation.
Finally, we obtain a set of triples each consisting of the start position, the length, and the importance score of a span.
We rank the triples according to the importance score in descending order.
Algorithm
Input: Victim Model F ; Text x ; Label y ;
Maximum size of slide window M
Output: Adversarial example 1 R ← ∅ ; t ← x 2 for w = 1 to M do for i = 1 to LEN ( x ) − w + 1 do s ← x i,...,i + w −
Calculate span importance I x ( s )
R ← R ∪ ⟨ i, w, I x ( s ) ⟩ 7 Sort R by I x ( s ) in descending order 8 for ( i , w , _) in R do
T ← R EPLACE ( t, i, w ) ∪ I NSERT ( t, i ) if ∃ ˜ x ∈ T s .
t .
F (˜ x ) ̸ =
y then return argmax ˜ x ∈ T,F (˜ x )
̸ = y SIMILAR
( x, x ) else
14 return NULL
2. Variable-Length Contextualized Transformations
Based on the triple ranking list, ValCAT performs sequential perturbations, where each step a target span in the original text is replaced by or inserted with a set of adversarial spans generated by an encoder-decoder language model.
The variablelength of the adversarial spans renders the language model enough space to produce more contextually appropriate candidates to improve fluency.
Meanwhile, our variable-length method expands the perturbation forms, for it supports multi-word transformations while is compatible with traditional oneto-one transformations.
Compared with previous methods, this further improves the attack success rate under the same perturbation constraints.
Below we elaborate on the details of the adversarial text generation.
Adversarial Span Generation
To generate adversarial candidates of each span, ValCAT applies an encoder-decoder language model to fill the mask token with a list of variable-length predictions.
First, the encoder language model confers the capability of predicting the masked tokens, which is trained with the masked language modeling (MLM) objective.
However, the encoder fills one mask token with only one suitable substitute rather than multiple words.
The ability of the decoder could fill the gap of the single word since the decoder is trained with a causal language modeling (CLM) which can predict the sequence after a prompt.
But, the decoder can only generate sequences at the end of the text.
Hence, ValCAT combined these two models with their complementary advantages, with the predictive capability at arbitrary positions of encoder and variable-length generation of a decoder.
With the candidate spans for target span, ValCAT performs two kinds of transformation operations,
Replace and Insert to generate the adversarial candidates.
Replace
The Replace operation substitutes the target span s i : i + m = w i ...
w i + m − 1 with another ˜ s .
For example, the target “ awesome ” in the text "
This place is awesome.
" could be replaced by the adversarial span “ pretty good ”.
Specifically, we first replace a mask token [mask] to s m : ˜
[Equation]
and generate a set of variable-length adversarial spans Z to fill the mask.
The adversarial text is denoted as:
[Equation]
where z ∈ Z is a contextualized span.
Since the language model is blind to the information of the target span, some of the generated adversarial spans may deviate from the original meaning to a large extent.
To avoid this situation, we only keep the adversarial spans with a high degree of semantic similarity to the original span.
Specifically, we use Universal Sentence Encoder (Cer et al., 2018) to restrict their cosine semantic similarity.
We also impose a limit on the word perturbation rate (See Section 3.1).
To prevent the text from being too long, we constrain the adversarial spans to be at most two words longer than the target span.
Insert
The Insert operation inserts a new span ˜ s in front of the target span
s i : i + m .
For example, "I like this quite interesting movie.".
Similar to the
Replace operation, it inserts a mask token in front of the target span: ˜
[Equation]
w i
[Equation]
1 [mask][ w i ...
w i + m − 1 ] w i + m ...w n , and corresponds with the adversarial text ˜
x iz =
w 1 ...
w i − 1 z w i ...w n .
The Insert perturbation also follows the same perturbation constraints, mentioned in Section 3.1.
Experiments
In this section, we evaluate ValCAT on two NLP tasks, text classification and natural language inference.
To demonstrate the effectiveness of ValCAT in terms of fluency, grammaticality and semantic similarity, following Li et al.
2021, we design and conduct a comprehensive human evaluation.
3. Implementation Victim model
In this work, we choose fine-tuned
BERT model as the victim of both the classification and the inference tasks.
Since BERT has achieved good results on a variety of NLU tasks and has been proven to be one of the most representative pre-trained transformers (Devlin et al., 2019).
Span Generation Model
To generate variablelength contextualized spans, we choose T5 (Raffel et al., 2020) for the generation.
T5 is a representative encoder-decoder language model that can predict the missing words within a corrupted piece of text, benefiting from the fill-in-the-blank pretraining.
Also, the large pre-training dataset C renders T5 rich prior knowledge to enable the diversity and the high quality of the generated spans.
Constraints
To achieve human imperceptibility and semantic preservation of the adversarial text, we impose constraints on the word perturbation rate and semantic similarity, as defined in Section 3.3.
Following previous practices (Jin et al., 2020;
Li et al., 2021), we set the thresholds of word perturbation rate and semantic similarity respectively for each dataset, with details shown in Appendix A.
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table]
MNLI
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
[Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table]
[Table] [Table]
Settings and Computation Cost
All results are derived from a single run since there is no randomness in our model.
The maximum size of the sliding window is set as 3.
In our implementation, we apply SpaCy (Honnibal and Montani, 2017), NLTK (Loper and Bird, 2002) for text manipulation.
We run ValCAT on Intel Xeon E5-2690 2.6GHz Processor with V100 GPU.
Averagely it takes 34 secs to generate a successful adversarial sample.
3. Datasets and Baselines
To investigate the effectiveness of ValCAT on different types of text, we evaluate it on several English datasets.
We randomly sample 1000 instances from each of the following datasets: three for text classification, i.e., AG News , Yelp Polarity and
IMDB ; and three for natural language inference, i.e., SNLI , MNLI and QNLI , with detailed information shown in Appendix B.
To prove the effectiveness of ValCAT comprehensively, we compared
ValCAT with several state-of-the-art word-level black-box attacks, i.e., TextBugger , TextFooler and
BERT-Attack .
Details of these attack methods are shown in Appendix C. Note that, all the datasets and baseline methods are publicly available and are used in accordance with their usage specifications.
3. Automatic Evaluation Metrics
We evaluate the effectiveness of ValCAT based on the following metrics:
• Attack success rate (Suc) : is the percentage of adversarial examples successfully interfered with the victim model’s prediction over the text dataset.
• Perplexity (PPL) : is an automatic metric to evaluate the probability of a sentence appearing in a natural corpus.
So PPL can reflect the text’s natural fluency, the lower the better.
We use GPT- (Radford et al., 2019) for this calculation.
• Semantic similarity (Sim) : is the cosine similarity between the original text and adversarial text
represented by Universal Sentence Encoder (USE) embedding (Cer et al., 2018).
• Word perturbation rate (Pert) : is the proportion of the modified words over the original text.
To evaluate the perturbation rate on variable-length perturbations more accurately, we design separate calculations for these two transformation operations.
For Replace operation, the number of modifications is max ( l t , l a ) − l LCS , where l t , l a , and l LCS are the lengths of the target span, the adversarial span, and their longest-common-subsequence (LCS), respectively.
For Insert operation, the number of modifications is the length of the inserted span.
• Grammar error (GErr) : is the incremental grammatical error of the adversarial text relative to the original.
We use LanguageTool 1 to count the grammatical errors within a text.
[Figure]
Results
The main experimental results are revealed in Table 2.
ValCAT outperforms baselines on multiple datasets in both classification tasks and inference tasks.
Compared with BERT-Attack, the best baseline method, ValCAT achieves higher success rates in all experiments and the improvement ranges from 5.9% even to 18.8%.
This is attributed to ValCAT’s ability to apply variable-length contextualized transformations on spans at any position, which largely enriches the pattern of perturbations.
In addition, ValCAT achieves the highest semantic similarity with the original text in all tasks.
The perplexity of the adversarial text generated by ValCAT is far superior to the baselines.
It is roughly only 50% of that of BERT-Attack and is almost consistent with the original text.
This indicates that the adversarial text generated by ValCAT is with high fluency.
The underlying reason is that multi-word transformations render the language model enough space to generate the adversarial spans with approximated distribution with natural language.
At the same time, ValCAT reaches the lowest average increase in the number of grammatical errors on five out of nine attacks, with only a slight disadvantage on the natural language inference tasks.
In general, ValCAT generates adversarial examples that achieve more promising attacks and are more imperceptible to humans.
Figure 2 shows the performance of ValCAT and baselines on the Yelp dataset under different constraint settings.
As we can see, the success rate of ValCAT decays most slowly as the limits of perturbation rate and semantic similarity increase, still achieving a success rate of almost 70% under the strictest constraints.
Moreover, ValCAT can maintain a low perplexity under any constraint, however, other attack methods have to sacrifice attack success rate to maintain their fluency.
3. Human Evaluation Design
We evaluate the quality of the adversarial examples from three perspectives: fluency and grammaticality, semantic similarity, and label consistency.
The first two metrics are evaluated by ratings, while the third one lets the annotator categorize the texts into a set of labels.
Five annotators with CET-4 certification performed the evaluation on AG News dataset.
All annotators were informed and consented to the use of the annotation, and were paid with remuneration higher than the regional average.
To construct the dataset for human evaluation, we randomly select 100 samples each from the dataset, whose adversarial texts generated by both ValCAT and BERT-Attack can mislead the victim model to make the same wrong classification decision among multiple classes.
For the evaluation of fluency and grammaticality, each original text and its two adversarial examples are presented in one group in a shuffled order and the annotators are asked to rate them.
For the evaluation of similarity, given the original text, the judges need to separately evaluate its semantic similarity with the two adversarial examples presented in random order.
The above two tasks ask the annotators to rate the text or the text pair from 1 to 5.
In each questionnaire, we give explicit criteria and clear examples for every score.
For the evaluation of label consistency, we mix all the original texts with the adversarial examples and let the annotators label
[Table]
the category of them, e.g., business or technology.
Results
For the two rating tasks, we normalize the rates of the annotators and calculate the average score, while for the labeling task we take the majority vote as the final result.
As shown in Table 3, ValCAT is rated with much higher fluency and grammaticality scores than BERT-Attack.
Also, it achieves obviously higher semantic similarity.
In terms of labeling accuracy, ValCAT slightly outperforms BERT-Attack, still indicating that ValCAT makes smaller changes to the meanings of the text from the aspect of human perception.
All these results demonstrate the superior quality of the adversarial examples generated by ValCAT.
Analysis 4. Ablation Study
We evaluate different attack strategies of ValCAT as in Table 4.
3-Many results in the lowest perplexity, for it renders the language model more space to generate a proper adversarial span.
It also requires the smallest number of queries, and we speculate the reason as it perturbs more words in a single transformation.
For the same reason, 3-Many is less likely to succeed since it’s easier to reach the perturbation constraint.
As expected, the combination of multiple types of Replace operation facilitates the attack success rate while increasing the number of queries.
The Insert operation achieves high similarity while requiring a large number of queries.
A comprehensive utility of all operations (i.e., ValCAT) achieves the highest success rate with the lowest perturbation rate, which fully demonstrates the advantages of the transformation diversity.
4. Impact of Candidate Numbers
From the results under different numbers of candidates constraints shown in Figure 3, we observe that the attack success rate is higher when there are more candidate spans.
Since we greedily select the adversarial span with the greatest impact on the decision, as the number of candidates increases,
[Table]
spans with low occurrence probability can be added to the text, making the perplexity higher.
This is especially true for difficult-to-attack datasets like
AG News.
[Figure]
of each dataset under different candidate numbers.
4. Properties of Transformations
We observe the properties of the transformations in the successful adversarial examples from three perspectives: type of transformation, length of span, and POS (Part of Speech) of span.
Averagely, 62% of the transformations in each example are Replace operations and 38% are Insert operations, indicating that Replace operations are more effective in most cases.
As shown in Table 10, the replaced spans are most likely the longer ones, while the adversarial spans generated by both two operations are rather short.
Additionally, Table 11 shows that the adversarial spans of Replace operation share identical POS distribution with the replaced span, which guarantees the fluency of the adversarial text.
The Insert operation tends to use adverbs and adjectives, which is consistent with the human intuition of inserting words into text.
4. Adversarial Training
We investigate how adversarial training can mitigate adversarial attack, as well as the power of our adversarial examples for adversarial training as a general defense to adversarial attacks.
We randomly sample 10,000 instances from the Yelp training dataset and apply ValCAT to generate adversarial examples.
These adversarial examples and their intermediate results, approximately 60, texts, are then used to fine-tune the BERT under the gold labels.
After adversarial training, the test accuracy of the victim model decreases from 98.3% to 98.0%.
As shown in Table 5, the attack success rate of ValCAT drops by about 20%, while both the word perturbation rate and the number of queries have significantly increased, indicating that the victim model is hard to attack after the adversarial training.
[Table]
4. Generalization
We evaluate the generalization of ValCAT in two aspects: 1) attack on other victim models and 2) transferability.
[Table]
Attack on Other Victim Models
We try to attack other common language models on the Yelp dataset using ValCAT.
Table 6 shows that LSTM and wordCNN, two traditional NLP models, are extremely vulnerable to ValCAT with a success rate of around 99%.
Interestingly, RoBERTa shows better robustness, with a 6.5% decrease in attack success rate relative to BERT, which we speculate is due to its more optimized pre-training approach.
Transferability
We evaluate the transferability of generated adversarial texts on all datasets.
Specifically, we utilize adversarial examples generated by different target models which successfully interfered with the victim model, to attack other tested models.
Results in Table 7 show that, adversarial examples generated by transformer models (BERT and RoBERTa) could cause similar accuracy decay on traditional NLP models (LSTM and wordCNN), and vice versa.
It indicates that transformer models (BERT and RoBERTa) have better transferability than traditional NLP models (LSTM and wordCNN).
[Table]
4. Limitation
ValCAT makes the best effort to improve the quality of the generated adversarial examples, including variable-length span ranking and multiple adversarial text generation strategies.
However, all these efforts result in a larger number of queries to the victim model, compared to word-level adversarial generation methods.
According to the results of the automatic and human evaluation, such an increase in the computation expense is tolerable, considering the significant improvement in adversarial example quality and attack success rate.
Furthermore, a simplified version of ValCAT, 1-Many (See
Table 4), outperforms the best baseline model in all aspects, including the number of queries.
In addition, although ValCAT reserves the semantic meaning of the perturbed text from the sentence perspective, there is still space to improve the semantic similarity between the generated span and the original span themselves in each perturbation.
This is because the fill-in-the-blank-style denoising objectives targeted by the encoder-decoder language models cannot see the masked original spans during the generation.
In the future, new training objectives need to be explored, where the original spans are visible to the language model to enable the generation of more similar contextualized spans for the perturbation.
Related Work
Textual adversarial attacks have been intensively studied (Wang et al., 2019; Zhang et al., 2020).
Early on, the character-level attack methods (Ebrahimi et al., 2018; Gao et al., 2018;
Li et al.,
2019) are widely used, but them would destroy words and are very perceptible (Pruthi et al., 2019).
Word-level attacks are now in the spotlight, evolving from substitution based only on the properties of individual words themselves (Zang et al., 2020;
Jin et al., 2020; Tan et al., 2020) to perturbing words by multiple strategies with knowledge of the context (Li et al., 2020; Garg and Ramakrishnan, 2020; Li et al., 2021).
However, these works only focus on context-sensitive substitution on single word, with absence of many possible forms of perturbations.
Limitations on single-word substitution hinders further improvement in attack success rate and fluency.
Although, Zhang et al. 2019b,
Wang et al.
2020 and Huang and Chang 2021 attempt to construct adversarial samples from levels above words by simply merge single-word, they all ignore the interactions between words are in finding important positions.
Although these existing works enrich the transformation form with various operations like insertion, deletion, merging, etc., they still treat single words as basic units of each perturbation.
In our work, we propose ValCAT, which takes into account the interactions between words in both ranking important spans and generating variable-length contextualized spans.
By introducing Sliding Window , ValCAT can find important spans.
Based on the mechanism of encoderdecoder, ValCAT can generate variable-length substitution candidates with two perturbation operations, Replace and Insert .
Conclusion
In this paper, we propose ValCAT, the first variablelength contextualized adversarial attack based on the encoder-decoder language model.
ValCAT considers the interaction between words for the vulnerable-position ranking and extends the form and the flexibility of the perturbation.
Experimental results on several datasets demonstrate the effectiveness of our model, which outperforms baselines in terms of attack success rate, adversarial example quality, transferability, and robustness against robust training.
A comprehensive human evaluation further verifies the high quality of our generated adversarial examples in reality.
Acknowledgements
This work is supported by National Natural Science Foundation of China (Grant No.
U1836213, U19B2034), National Key R&D
Plan (Grant No.2018YFB2101501), Industrial
Internet Innovation and Development Project (Grant No. TC200H02X, TC200H02Y), and the
Huawei Technologies Co., Ltd under Grant No.
TC20200917004.
A Constraints
We impose constraints on the generated adversarial texts in terms of perturbation rate and semantic similarity, as shown in Table 8.
[Table] [Table]
B Datasets
We employ three datasets for text classification and three datasets for natural language inference as described below.
In our experiments, we randomly sample 1000 records.
• AG News : a collection of news articles categorized into 4 types: World, Sports, Business, and Sci/Tech (Zhang et al., 2015).
• Yelp Polarity : positive and negative restaurant reviews collected from yelp (Zhang et al., 2015).
• IMDB : a dataset of movie reviews for binary sentiment classification (Maas et al., 2011).
• SNLI : a collection of human-written English sentence pairs (Bowman et al., 2015).
Each sentence pair consists of a premise and a hypothesis, which is necessary to determine whether it is entailment, contradiction, or neutral.
• MNLI : a similar dataset to SNLI (Williams et al., 2018), but from a variety of genres.
• QNLI : a version of SQuAD which has been converted to a binary classification task (Wang et al., 2018).
C Baselines.
We compare ValCAT with state-of-the-art wordlevel black-box attacks:
• TextBugger : an attack model compounded by five bug generation methods (Li et al., 2019).
Such methods include character insertion, character deletion, character swapping, homograph character replacement, and synonym replacement.
• TextFooler : classical adversarial attack algorithm based on synonym substitution (Jin et al., 2020).
Candidate
synonyms
are the closest neighbors
of the replaced word in the counter-fitting word embedding space.
It limits the cosine similarity and makes the POS consistent.
• BERT-Attack : a state
-of-the-art contextualized attack model using BERT to fill mask tokens (Li et al., 2020).
It serves as a representative of the similar BERT-based algorithms, such as BAE (Garg and Ramakrishnan, 2020) and CLARE (Li et al., 2021).
D Performance of Encoder-Decoder Models
We present the results of generating adversarial spans by several language models in the T5 family in Table 9.
T 5 large and mT 5 base take a longer time to generate adversarial span due to their larger capacity.
The higher perplexity of T 5 v 1 . 1 base is, we conjecture, resulted from its specifically different structure.
In short, T 5 base is good enough for adversarial span generation.
[Table]
E Properties of Transformations
We observe the properties of the transformations in the successful adversarial samples from three perspectives: type of transformation, length of span, and POS (Part-of-Speech) of span.
Results shown as in Table 10 and Table
[Table] [Table]