SemAttack : Natural Textual Attacks via Different Semantic Spaces
Abstract
Recent studies show that pre-trained language models (LMs) are vulnerable to textual adversarial attacks.
However, existing attack methods either suffer from low attack success rates or fail to search efficiently in the exponentially large perturbation space.
We propose an efficient and effective framework SemAttack to generate natural adversarial text by constructing different semantic perturbation functions.
In particular, SemAttack optimizes the generated perturbations constrained on generic semantic spaces, including typo space, knowledge space ( e.g. , WordNet), contextualized semantic space ( e.g. , the embedding space of BERT clusterings), or the combination of these spaces.
Thus, the generated adversarial texts are more semantically close to the original inputs.
Extensive experiments reveal that state-of-the-art (SOTA) large-scale LMs ( e.g., DeBERTa-v2) and defense strategies ( e.g., FreeLB) are still vulnerable to SemAttack .
We further demonstrate that SemAttack is general and able to generate natural adversarial texts for different languages ( e.g., English and Chinese) with high attack success rates.
Human evaluations also confirm that our generated adversarial texts are natural and barely affect human performance.
Our code is publicly available at https://github.com/
AI-secure/SemAttack .
Introduction
Deep neural networks have achieved remarkable success in many machine learning tasks.
Particularly, BERT (Devlin et al., 2019) has inspired a suite of large-scale pre-trained language models (Yang et al., 2019;
Zhang et al., 2019; Lan et al., 2019), which achieved new SOTA for many NLP tasks.
In addition to BERT’s dominant performance on English datasets, Tenney et al.
(2019) points out that BERT is similarly effective on other languages
[Table]
such as Chinese, whose granularity of words is more complex, given the model’s ability to disambiguate information from high-level representations (Ding et al., 2019).
Although effective for many NLP tasks, the robustness of these neural models is often challenged by carefully crafted adversarial examples.
Specifically, attackers can add subtle humanimperceptible perturbation to the original input and induce dramatic changes in model output.
Current adversarial text generation (Jia and Liang, 2017; Li et al., 2018; Alzantot et al., 2018) is mainly heuristic and only achieves low attack success rates for
BERT-based models.
Other work (Cheng et al., 2020; Ebrahimi et al., 2018) allows an input word to be substituted by any other word in the vocabulary, which fails to consider the semantic perturbation constraints and is prone to invalid adversarial examples.
Recent work (Jin et al., 2020; Zang et al., 2020) relies on external knowledge to constrain the perturbation yet poorly handles large search space that grows exponentially with the input length, as it requires hundreds of queries to generate one adversarial example in practice.
Furthermore, most existing textual adversarial attacks are not generalizable to other languages,
Original Input: They need to hire experienced sales rep who are mature enough to handle questions and sales.
Original Input: You don't know what I've experienced here.
All I can say is don't go to this place.
There's a much better mall in town.
Original Prediction: 1-star (most negative)
Original Prediction: 1-star (most negative) experienced experiencing encountered saw witnessed participated experience had seen experienced experienced good trained supervised skilled professional expert expertise proﬁcient "experienced"as a verb "experienced
[Figure] as [Figure] adjective
[Figure]
Cluster
Original Input: They need to hire experienced sales rep who are mature enough to handle questions and sales.
Original Input: You don't know what I've experienced here.
All I can say is don't go to this place.
There's a much better mall in town.
Original Prediction: 1-star (most negative)
Original Prediction: 1-star (most negative) experienced experiencing encountered saw witnessed participated experience had seen experienced experienced good trained supervised skilled professional expert expertise proﬁcient
Adversarial Input: They need to hire skilled sales rep who are mature enough to handle questions and sales .
Adversarial Input: You don't know what I've encountered here.
All I can say is don't go to this place.
There's a much better mall in town.
[Figure]
[Figure]
[Figure]
verb
[Figure]
due to unique language-dependent characteristics and the lack of universal linguistic resources. Moreover, character-level adversarial attacks designed in English context (Ebrahimi et al., 2017) are often ineffective for Chinese-character-level attacks, as the size of candidate characters increases by two orders of magnitude, resulting in surging computational costs especially for BERT-based models.
We tackle these limitations in textual adversarial attacks by proposing an effective and efficient framework SemAttack , which can be used to further evaluate the robustness of NLP models.
We generalize existing word-level attacks and propose generic semantic perturbation functions, which optimize and constrain the perturbations within different semantic spaces, so that the generated adversarial texts retain their semantic meaning.
We mainly consider three types of semantic spaces: ( 1 ) Typo
Space , using typo words or characters that can fool the models but not human judges; ( 2 ) Knowledge
Space , utilizing external linguistic knowledge base ( e.g. , WordNet (Miller, 1995)) as valid perturbation candidates; and ( 3 ) Contextualized Semantic Space , exploiting the embedding space of BERT to generate a contextualized perturbation set semantically close to the original word (Figure 1).
The contextualized semantic space does not require additional knowledge, and therefore can scale to other languages, especially low-resource languages where a large knowledge base is unavailable.
After the candidate semantic space is determined,
SemAttack searches for the optimal perturbation combination.
Instead of requiring thousands of queries to generate one adversarial example, optimal perturbations can be efficiently found in the embedding space by solving an optimization problem.
We also control the magnitude of perturbation to be small as shown in Table 1.
Extensive experiments on four datasets demonstrate that SOTA
LMs and defense methods are still vulnerable to our adversarial attack, which are natural and barely affects human judgment.
For example, the accuracy of BERT sentiment classifier drops from 70 .
6% to 2 .
4% by simply replacing fewer than 5% words with our method.
Although these adversarial examples are generated in the whitebox setting, they can effectively transfer to two different blackbox attack settings while retaining higher than 90% attack success rate for BERT and other large-scale
LMs such as DeBERTa-XXLarge.
Our contributions are summarized as follows: 1 )
We propose a unified and effective adversarial attack framework SemAttack by constructing semantic perturbation functions, which constraint perturbations within different semantic spaces and their combinations.
SemAttack generates contextualized perturbations that require no external knowledge and thus can easily adapt to different languages.
3 ) We conducted extensive experiments on different datasets and languages to show that adversarial texts generated by SemAttack are more semantically close to the benign inputs, and achieve much higher attack success rates than existing attack algorithms in different settings.
4 ) Comprehensive studies demonstrate that SOTA LMs and defenses are still vulnerable to SemAttack , and human evaluation verifies the naturalness and validity of our adversarial examples.
SemAttack 2. Problem Formulation
Given an input x =
[ x 0 , x 1 , ..., x n ] , where x i is the i -th input token, the classifier f maps the input to final logits z = f ( x ) ∈ R C , where C is the number of classes, and outputs a label y = arg max f ( x ) .
During attack, we evaluate the effectiveness of attack algorithms by calculating the targeted attack success rate (TSR):
[Equation]
and untargeted attack success rate (USR):
[Equation]
where the attack algorithm generates one adversarial sentence for each sample to form an adversarial dataset D adv , y ∗ is the targeted false class, y is the ground truth label, and 1 ( · ) is the indicator function.
2. Semantic Perturbation Functions
To control adversarial examples to be semantically close to the original input, we design a general form of semantic perturbation function F , which takes one token x as input, and returns its candidate perturbation space S
= { x ∗ 0 , x ∗ 1 , ..., x ∗ n } .
We next discuss the types of perturbation function F .
Typo-based Perturbation Function F T constrain the search space S in the typo space , which uses typo words or characters to replace original tokens so that human can still understand the original meaning while models are fooled.
In English, we follow the generation process introduced in
TextBugger (Li et al., 2018) to generate typos.
In order to illustrate how our proposed method can be easily adapted to multilingual settings, we also generate typo-based semantic space for Chinese.
Specifically, for each Chinese token x , we prepare a set of common Chinese characters S that look similar ( “ 形 近 字 ” ) or have the same pronunciation ( “ 音 近 字 ” ) as the original token x .
We use the open-source similar Chinese character list that contains more than 9,000 common Chinese characters.
To search for the Chinese characters with the same pronunciation ( i.e., pinyin), we first query the pronunciation of input x and then choose the characters returned based on the same pronunciation.
If x is a heteronym that has multiple pronunciations, we only use one pronunciation to do the query.
We also limit the size of Chinese characters of the same pronunciation to be less than 6 so that the search space is not too large.
For the Chinese example shown in Table 1, we use “ 甚 ” to replace “ 什 ” as they share the same pronunciation and are a common typo that will not affect human understanding.
considers the knowledge space to constrain the perturbation search space S .
Specifically, F K utilizes existing knowledge base to build a candidate perturbation set.
In our work, we use WordNet as an example to illustrate how our framework can integrate rule-based knowledge to enhance the quality of adversarial examples.
WordNet is a large lexical dataset of more than 200 languages that groups words into sets of cognitive synonyms.
With the manually labeled semantic relations among words, synonyms queried from WordNet ( i.e. , synsets) share the same semantic meaning as the query word x .
Therefore we choose these synonyms returned from WordNet to be the search space S .
We note that WordNet also contains hypernyms and hyponyms information, but including them into the search space may incur some unnatural replacement ( e.g. , replacing “fifth” with “rank”).
Therefore, we only consider synsets as the candidate search space S .
In addition, even for the same token ( e.g ., “use”) in WordNet, it may have different part-of-speech (POS) tags ( e.g. , “use” as verb or as noun), and thus has different synonyms ( e.g., “exploitation” for noun “use” and “practice” as verb “use”), which may result in nonsensical replacement.
In order not to include synonyms that have unusual part of speech, we counted the frequency of POS in the synset and only selected the words with the most frequent POS.
Using the synonym set
S after filtering, we are able to generate adversarial input texts that mislead models’ prediction while barely affect on human understanding.
Contextualized Semantic Perturbation Function F C is a novel perturbation function that explores the BERT embedding space and searches for contextualized perturbation to tackle the issue of most language tokens being polysemous.
Previous work (Li et al., 2018; Jin et al., 2020) takes it as a standard practice to use the proximity in embedding space to query the semantic similarity.
However, their embedding space is built on a noncontextualized word embedding from GLoVE (Pennington et al., 2014) or Word2Vec (Mikolov et al.,
2013), thus failing to consider the polysemy when generating the perturbation.
We propose to explore the BERT embedding space, which is verified by (Hewitt and Manning, 2019; Coenen et al., 2019; Papadimitriou et al., 2021) that BERT embeddings can preserve syntactic and semantic information for word sense disambiguation better than GLoVE or Word2Vec.
So the contextualized space from F C is valid semantic perturbations.
Similar to our parallel work (Li et al., 2020) of using BERT to generate adversarial perturbations, F C also does not require external linguistic resources such as POS checker.
Thus F C can be adapted to other languages, as long as pre-trained BERT of such language models is available.
Specifically, we first choose a set of commonly used tokens X .
For each word x ∈ X , we select at most 100 example sentences from Wikipedia that contain the word x so that these sentences represent different meanings of x in different contexts.
We then feed these sentences into a pretrained BERT model to obtain the contextualized embeddings for each word x .
Finally, the contextualized embeddings for all words in X formulate a large BERT embedding space.
Figure 1 visualizes a BERT embedding space projected into 2D space by PCA.
To query the search space S for token x , we first calculate the BERT embedding of token x given its context sentence.
Even for the same token, given different contexts and meanings, BERT will generate distinct representations in the high dimensional embedding space.
For the example in Figure 1, the token “experienced” given different contexts have different latent representations and neighbors.
Then we use k nearest neighbors (KNN) algorithm to choose the neighbors of the contextualized embedding of x as its perturbation search space S .
To ensure high quality of search space S , we further filter S and only return the words that appear more frequently than a threshold ϵ among k nearest neighbors.
In this way, we remove the noisy tokens that are rarely used and retain the high-quality neighbor tokens whose contextualized semantics are mostly close to the original token x .
Discussion.
The final search space S can be the union of the search spaces mentioned above.
This makes existing defense algorithm (Jones et al., 2020) difficult to apply, as they can only defend against typo-based perturbation but fails to detect other types of perturbation.
F is a generalization of most existing word-level textual adversarial attacks.
Though F T and F K have been discussed in the previous literature (see §Related Work), we note that the goal of our paper is not to improve or propose better typo or knowledge perturbation, but to consider multiple semantic spaces at the same time to help generate natural high-quality adversarial examples.
2. Attack Algorithm SemAttack
The full pipeline is shown in Appendix Algorithm 1.
Essentially, SemAttack searches for the optimal perturbations from different semantic spaces determined by semantic perturbation functions, which is efficiently solved as an optimization problem so that we only perturb as few tokens as possible while achieving the targeted attack.
Unlike generating adversarial examples in the continuous data domain, it is difficult to directly utilize the gradient to guide token substitution due to the discrete nature of text.
Thus, we search perturbation in the embedding space and map the perturbed embedding back to tokens.
Specifically, the one-hot representation of each discrete token x i ∈ R | V | ( V is the vocabulary set) is mapped into an embedding space of dimension d c via the embedding matrix M e ∈
[Equation]
We optimize perturbation e ∗ added to the original embedding e for m iterations.
In each iteration, we freeze all the parameters of the classifier f and optimize variable e ∗ only.
Following Carlini and
Wagner (2016), we minimize the loss function as:
[Equation]
where the first term controls the magnitude of perturbation, while g ( · ) is the attack objective function depending on the attack scenario.
c weighs the attack goal against attack cost.
In targeted attack scenarios, we define g ( · ) as:
[Equation]
where t is the targeted false class and f ( x ′ )
i is the ith class logit.
A larger κ encourages the classifier to output targeted false class with higher confidence.
In untargeted attack scenarios, g ( · ) becomes
[Equation]
where t is the ground truth class.
After each iteration of gradient descent, we have an optimized perturbation e ∗ in the embedding space that tends to fool the classifier f with small perturbations.
We choose the perturbed token x ′ i ∈
S = F ( x i ) that is from the semantic search space
S returned by F ( x i ) and semantically closest to the perturbed embedding e ′ i .
[Equation]
Finally, we obtain an optimal perturbation e ∗ after repeating the optimization step and token substitution step for m iterations.
Under such settings and constraints, most tokens remain the same and very few are perturbed to their semantically close neighbors.
Thus, the adversarial examples still look valid to humans but can fool the models.
Experimental Results
In this section, we conduct comprehensive experiments to evaluate our attack method in various settings.
We first apply our attack method to two standard NLP models, BERT and SOTA SelfAttention LSTM.
We evaluate on two different types of NLP tasks , sentiment analysis and natural language inference (NLI).
Secondly , we investigate the effectiveness of SemAttack against
SOTA large-scale language models and defense methods.
Thirdly , we take Chinese as an example to measure SemAttack ’s generalization ability across different languages.
We evaluate BERT models finetuned on two Chinese datasets.
Finally , we conduct extensive human evaluations on both
English and Chinese datasets.
We find that: 1 ) SemAttack can achieve better attack success rates than existing textual adversarial attack methods with better language quality and adversarial transferability.
2 ) SOTA LMs and defense methods are still vulnerable to our SemAttack .
SemAttack is a general textual adversarial attack framework and can be easily adapted to other languages in addition to English with high attack success rates.
Adversarial examples generated by SemAttack are natural and barely affect human performance.
3. Whitebox and Blackbox Attack Datasets
For sentiment classification task, we choose the standard 5-class sentiment classification dataset, Yelp dataset.
Note that unlike previous work (Li et al., 2020; Jin et al., 2020) that uses binary sentiment classification dataset , we focus on the standard 5-class Yelp dataset to further evaluate the targeted attack capability of SemAttack .
For NLI task, we choose SNLI dataset.
The detailed dataset descriptions are in Appendix §C.
Models
We evaluate the robustness of BERT and Self-Attention LSTM (Lin et al., 2017).
We present their test accuracy on the benign test sets in Table 2.
More hyperparameter settings and training details are discussed in Appendix §B. Attack
Baselines
We consider SOTA whitebox and blackbox attack baselines.
• HotFlip (Ebrahimi et al., 2017) is a whitebox attack method for generating adversarial examples on both character-level and word-level.
In terms of preserving semantic meaning, we only use word-level attacks in our experiments, which uses gradient-based optimization method to flip words.
• TextFooler (Jin et al., 2020) is a blackbox attack method for generating adversarial text, which uses similarities between pre-calculated word embeddings to find synonyms for each word.
• BERT-Attack (Li et al., 2020) is a strong blackbox attack method using pre-trained masked language models such as BERT to replace words in input sentences, where pre-trained masked language models provide candidate words that have high semantic similarity between original texts.
These methods all perform untargeted attacks.
We adapt them to both untargeted and targeted attack settings in our experiments.
Attack Goal
In the sentiment analysis task, we consider the targeted attack , and choose the most opposite sentiment class as the targeted class, so sentences with original label lower than 2 ( negative ) are attacked to class 4 ( most positive ), and others are attacked to class 0 ( most negative ).
In the NLI task, Contradiction and neutral will be attacked to entailment while entailment will be attacked to contradiction .
Adversarial Attack Evaluation
We perform
SemAttack on BERT and LSTM-based classifiers in both the whitebox and blackbox settings.
The whitebox setting approximates the worst-case scenario, where attackers have the access to the model parameters and gradients; while the blackbox setting assumes that attackers can only access the model’s output confidence.
For the whitebox attack shown in Table 2,
SemAttack can outperform all the SOTA baselines and achieve the highest success rates in both untargeted and targeted settings for BERT and
LSTM-based models with smaller or comparable perturbation rates.
For example, untargeted
SemAttack achieves 97 .
6% attack success rate
[Table]
[Figure] [Figure] [Table] for BERT models by perturbing 4% words on the
Yelp dataset, when searching from the combination of the semantic spaces of F T , F K and F C .
To adapt SemAttack to the blackbox attack setting, we distill the blackbox (teacher) model to train a whitebox (student) model, and transfer the adversarial examples from the whitebox student model to attack the blackbox model.
More details can be found in Appendix §D.
For the blackbox attack shown in Appendix
Table 8, the transferability-based SemAttack achieves higher attack success rates than SOTA blackbox attacks for self-attention LSTM.
We also observe that BERT-ATTACK achieves a higher attack success rate on BERT than SemAttack .
We think it is mainly because that BERT-ATTACK adopts an aggressively large candidate perturbation size (top- k =48), which may lead to large semantic changes (indicated by the worse human performance as shown in Table 5).
For instance, we observe that some words are even changed to their antonym in BERT-ATTACK.
On the contrary, the average size of search spaces for SemAttack (+all) is only 11 . 87 , aiming to guarantee the naturalness and validity of the generated adversarial examples.
We present more details of our semantic space in Appendix §D.3.
In addition, we observe that Self-Attention
LSTM models are more robust than BERT in most settings.
For example, we achieve the highest USR of 88 .
1% in whitebox attack on the Yelp dataset, which is 9 . 5% lower than BERT in the same setting.
This suggests that self-attention mechanism can improve the robustness of vanilla WordLSTM by a large margin, as WordLSTM is known less robust than BERT (Jin et al., 2020).
3. Attack SOTA LMs and Defense Methods
In this section, we evaluate SemAttack and baseline attacks against various SOTA large-scale language models and defense methods.
Dataset and Attack Baselines
Following §3.1, we evaluate SemAttack on SNLI dataset.
We choose the same blackbox attack methods,
TextFooler and BERT-Attack, as our baselines.
Models
We consider the following models and defense methods following the Adversarial GLUE
Benchmark (Wang et al.,
The selected largescale models and defense methods not only represent SOTA performance on NLU tasks, but also achieve the
highest robustness in the leaderboard
• DeBERTa
(He et al., 2020) improves BERTbased models by introducing disentangled attention mechanism and enhanced mask decoder, which is one of the best models in the GLUE leaderboard (Wang et al., 2018).
In our experiment, we use DeBERTa (Large) and DeBERTa (XXLarge-v2).
• FreeLB (Zhu et al., 2019) is an adversarial training algorithm that defends adversarial attacks by adding perturbations to word embeddings and
minimizing the corresponding adversarial loss.
Attack Goal
To demonstrate the model robustness in an approximately real-world scenario, we consider a zero-query setting , a more rigorous and common scenario that assumes the target models are not accessible during the attack phase.
Since we can not access the target model, we perform a transferability-based backbox attack.
Specifically, we attack the selected language models and defense methods using adversarial SNLI texts generated by
SemAttack against BERT classifier in §3.1.
Adversarial Attack Evaluation
We finetune the above models on the SNLI dataset and attack them using adversarial texts generated against BERT.
The results are shown in Table 3.
For the zero-query setting , SemAttack always achieves the highest success rates.
Specifically, among all the attack methods, SemAttack (+ F T ) always has the highest USR regardless of the model it is tested on.
For example, on the largest model, DeBERTa (XXLarge-v2), we achieve 90 .
5% USR, which is 7 . 1% higher than
BERT-ATTACK.
Furthermore, we find that increasing the number of model parameters and expanding the model architecture have little effect on defense against adversarial attacks .
DeBERTa (XXLarge-v2), for example, is substantially larger than DeBERTa (Large), yet the attack success rates are similar.
In some cases DeBERTa (XXLarge-v2) is even less robust than DeBERTa (Large).
We also observe that introducing some defense strategies slightly improves the model’s robustness.
When we use the defense strategy of FreeLB, we can see that the robustness increases, but it is still not satisfactory to defend existing adversarial attacks.
3. Adapt SemAttack to Chinese Datasets
We evaluate our performance on the following two datasets in Chinese: 14-category news classification dataset THUNews (Sun et al., 2016) and 11 -class Wechat Finance dataset.
More details about these datasets are introduced in Appendix C
. Models
We use BERT pre-trained on Chinese corpora and finetune on the two datasets separately.
After finetuning, our BERT achieved 0 .
818 accuracy on THUNews dataset and 0 .
891 on Wechat
Finance Dataset, as shown in Table[-
-]
Attack Baselines
Since both TextFooler and
BERT-Attack adopt an aggressively large perturba- [Table] tion candidate space and thus require additional language resources (e.g., POS checker; stop words filtering) to ensure the proposed candidate words are valid, they cannot be adapted to Chinese due to the lack of corresponding language resources.
Therefore, we adapt HotFlip for Chinese classification task, since it does not rely on any other linguistic resources.
We also adapt it to transferability-based blackbox attack settings as well as the targeted attack setting for fair comparison.
Attack Goal
In this paper, we choose the targeted attack class as “technology news” for THUNews dataset and “Bank” for Wechat dataset (when the ground truth label is the targeted class, we switch the target to another random class).
This strategy achieves the highest targeted attack success rate as shown in Appendix F.7.
Adversarial Attack Evaluation
In the whitebox attack scenario in Table 4, SemAttack is able to make the model mistakenly classify nearly all sentences with only a small number of characters being manipulated in both targeted and untargeted settings.
The untargeted attack achieves 99% success rate by substituting merely two tokens on average on the THUNews dataset.
On Wechat Finance dataset, it achieves 98 .
7% attack success rate by perturbing 4 .
6% tokens on average in the input sequences.
In the targeted attack scenario, we always make BERT output as our expected false class on both datasets, resulting in a huge performance drop on BERT models.
We achieve 92 .
1% and 98 . 0% on THUNews dataset and Wechat Finance dataset, respectively.
[Table] We also present the blackbox attack results in Table 4.
We can see that SemAttack (+all) achieves the highest success rates in most cases, which suggests that our semantic perturbation spaces have high adversarial transferability.
Note that we do not present the targeted attack on Wechat Finance dataset for HotFlip since all attack attempts failed.
Ablation Studies
We conduct a series of ablation studies such as exploration of BERT embedding space, attack strategies, ℓ p norm selection for
Eq.(4), hyper-parameter selection, and attack efficiency comparison, etc.
in Appendix F.
3. Adversarial Text Quality Evaluation
To confirm that our generated adversarial texts are valid and natural to humans, we conduct both automatic evaluation and human evaluation on both English and Chinese NLP tasks, considering language quality and utility preservation.
More evaluation details can be found in Appendix G.
Language Quality Evaluation
We sampleoriginal sentences from the test set for both Chinese and English such that all of them can be successfully attacked by SemAttack and our baselines.
For automatic evaluation, we consider the average perturbation rate, perplexity (PPL) (based on
GPT-2), and BertScore as metrics to indicate the language quality.
For human evaluation, we present every generated adversarial sentence to 5 human annotators, ask them to rate the language quality from 1 to 5, and calculate the average ratings.
We present the evaluation results in Table 5.
We can see that SemAttack has the best human ratings across different baselines for both Chinese and English.
In terms of automatic evaluation metrics, we observe that SemAttack is quite close to the SOTA BERT-ATTACK.
We think the reason why SemAttack is slightly weaker than
BERT-ATTACK in terms of PPL and BertScore is that SemAttack also considers typos and knowledge-based perturbations.
Such perturbations usually look good to humans, but may greatly [Table] impact the scores calculated by pretrained language models such as GPT-2 and BERT.
Utility Preservation Evaluation
To evaluate human performance on our generated adversarial data, we randomly sample 50 clean sentences andadversarial sentences generated by the targeted
SemAttack (+all) for both the English Yelp and the Chinese THUNews dataset.
For each sentence, we present the annotators with two labels: a ground truth label and a targeted wrong label (e.g., the most opposite sentiment), and request annotators to choose the correct one.
Both clean text and adversarial text are randomly shuffled.
The detailed evaluation results with standard deviation are shown in Table 6.
We find that our adversarial text barely impacts human perception, as the human performance on adversarial Yelp data is 93 .
9% , only 2% lower than the clean data.
Human performance on the adversarial Chinese THUNews is 93 .
7% , which is very close to the performance of 94 . 0% on the clean dataset.
Related Work
Our proposed semantic perturbation functions generalize the existing textual adversarial attacks.
For typo-based perturbation function F T , existing work (Li et al., 2018; Ebrahimi et al., 2017) applies character-level perturbation to carefully crafted typo words ( e.g. , from “foolish” to “fo0lish”), thus making the model ignore or misunderstand the original statistical cues.
Knowledge-based perturbation function F K uses knowledge base to constrain the search space.
For example, Zang et al.
(2020) uses sememe-based knowledge base from HowNet (Dong et al., 2010) to construct a search space for word substitution.
Different from our contextualized semantic perturbation function F C , other work (Jin et al., 2020;
Li et al., 2018) uses a non-contextualized word embedding from GLoVe (Pennington et al., 2014) or
Word2Vec (Mikolov et al., 2013) to build synonym candidates, by querying the cosine similarity or eu- clidean distance between the original and candidate word and selecting the closet ones as the replacements.
However, some antonyms also have high cosine similarity in the Word2Vec space.
Thus, additional hand-crafted filtering rules are needed to ensure that the meaning is not changed.
Other work (Garg and Ramakrishnan, 2020; Li et al., 2020, 2021) also leverages pre-trained models to generate contextualized perturbations by masked language modeling, which is a parallel work to SemAttack , where we explore the BERT embedding clusters to generate high-quality adversarial examples.
In terms of optimization, unlike the heuristicbased previous work that uses greedy (Jin et al., 2020) or genetic algorithms (Zang et al., 2020) which search for the optimal perturbations, or gradient-based methods (Wang et al., 2020; Guo et al., 2021) which search for perturbation on a tree-autoencoder with only syntactic constraints or a distribution of adversarial examples, we use an optimization-based method to efficiently and effectively search for the optimal adversarial perturbation in the semantic preserving spaces to ensure the validity and naturalness of perturbed sentences.
Conclusion
In this paper, we propose a novel semantic adversarial attack framework SemAttack to probe the robustness of LMs.
Comprehensive experiments show that SemAttack is able to generate natural adversarial texts in different languages and achieve higher attack success rates than existing textual attacks.
We also demonstrate that existing SOTA
LMs and defense methods are still vulnerable to
SemAttack .
We expect our study to shed light on future research on evaluating and enhancing the robustness of LMs for different languages.
Acknowledgments
We gratefully thank the anonymous reviewers and meta-reviewers for their constructive feedback.
This work is partially supported by the NSF grant
No.1910100, NSF CNS 20-46726 CAR, and Sloan
Fellowship.
A Broader Impact
In this paper, we propose an effective and novel adversarial attack framework SemAttack to probe the robustness of state-of-the-art NLP models.
Our experiments show that even pre-trained large-scale language models for different languages are not robust under SemAttack .
We will open-source our code to shed light on future research to evaluate and enhance the robustness of NLP models.
Considering attackers may leverage our code to perform adversarial attacks to NLP models, we suggest using adversarial training as an effective approach to improving adversarial robustness, and our proposed framework has provided an efficient way to generate these adversarial training data.
B Model Settings
Whitebox Classifier
For English dataset, we use
BERT and self-attention LSTM as the classifiers.
BERT is a transformer (Vaswani et al., 2017) based model, which is unsupervised pretrained on large corpora.
We use the 12 -layer BERT-base model with 768 hidden units, 12 self-attention heads, and 110 M parameters.
For self-attention LSTM, we set the self-attention LSTM to 10 attention hops internally, and use a 300 -dim BiLSTM and a 512units fully-connected layer before the output layer.
We fine-tune BERT on Yelp dataset with a batch size of 64 , learning rate of 2 e − 5 and early stopping.
We train the Self-attention LSTM-based model on 500 K review training set for 29 epochs with stochastic gradient descent optimizer under the initial learning rate of 0 . 1 .
We run our experiments on i7-7820X CPU with 128 GB memory on one RTX 2080Ti GPU.
For both Chinese datasets, we use BERT (Devlin et al., 2019) as the classifier.
Chinese BERT is a transformer (Vaswani et al., 2017) based model, which is unsupervisedly pretrained on large Chinese corpora and is effective for downstream Chinese NLP tasks.
We use the 12-layer BERT-base
model with 768 hidden units, 12 self-attention heads and 110M parameters.
We fine-tune BERT on each dataset independently with a batch size of 64, learning rate of 2e-5 and early stopping.
Blackbox Classifier
The blackbox LSTM and BERT classifiers are trained/finetuned from scratch.
The parameters of blackbox models are different from the whitebox ones.
C Dataset Details
• Yelp Dataset consists of 2 .
7 M yelp reviews and each one has its corresponding star level to be predicted by our model.
The target stars level is an integer number in the inclusive range of [0 , 4] , which can be treated as 5 classes.
We follow the process in Lin et al.
(2017) to randomly select 500K review-star pairs as the training set, 2 , 000 as the development set, and 2 , 000 as the test set.
• SNLI Dataset (Bowman et al., 2015) consists of 570 k human-written English sentence pairs and each pair contains one premise and one hypothesis.
These pairs are manually labeled as entailment, contradiction, or neutral, which can be predicted by our model.
We use 550 k pairs as training set, 10 k as the development set, and 10 k as the test set.
We follow the baseline setting (Li et al., 2020) and only allow perturbations on hypotheses (Table 2) or premises (Appendix Table 9 & 10).
• THUNews
(Sun et al., 2016) is a public Chinese 14-category news classification dataset.
It consists of more than 740 k news articles from Sina News between 2005 and 2011.
These articles are classified into 14 categories, such as education, technology, society and politics.
To speed up the evaluation process, we use the news titles for classification.
We evenly sample articles from all classes, and use 585 , 390 articles as the training set, 250 , 682 as the development set, and another 1 , 000 as the testing set for the adversarial evaluation.
• Wechat Finance Dataset is a private dataset from the Wechat team, who collect 13 , 051 subscription
accounts in the finance domain.
They use crowd-sourcing to classify the account intosub-classes, such as insurance, banks and funds.
Each account description has 94 .
18 Chinese characters on average.
We split the dataset into training set ( 10 , 000 descriptions), validation set ( 1 , 163 descriptions) and test set ( 1 , 888 descriptions).
[Table]
together with benign accuracy of two models.
In SNLI
Dataset, we calculate the average length of premises (P) and hypotheses (H) separately.
Input: Input tokens
F Output: Adversarial text x 1: Initialize 0 2: e
M x 3: e ′ ← e e
4: x ′ ← x 5: k m
1 do 6:
Phase
I
Optimize k 7:
L e
|| e ∗ k
|| p + c · g ( x ′ ) 8: e ∗
1 ← e ∗ k − α
Phase II
Substitution 10: e ′ ← e e ∗
k
i n do 12:
S = F ( x i ) //
Get perturbation search space 13: x ′ i ← arg min x ′ i ∈S (
| e ′ i − M x ′ i | p ) 14: end for 15: end for 16: return x ′ D Experimental Setting D. Attack Setup
SemAttack is a whitebox attack method which requires access to the model parameters and gradients.
However, it can be easily adapted to blackbox settings.
In our experiment, we consider the following two blackbox settings: a soft-label blackbox setting and a more rigorous zero-query blackbox setting.
In soft-label blackbox setting, attackers can only query the classifier for output probabilities on a given input.
We adapt our method to this setting by distillation.
The output confidence of the blackbox (teacher) model is used to train a student model.
Then we run whitebox attacks on the student model and attack the teacher model with adversarial instances provided by the student model.
In zero-query blackbox setting, the target models (usually state-of-the-art large-scale language models enhanced with cutting-edge defense methods) are unavailable during the attacking phase, which is a common scenario in real-world applications and better demonstrates the algorithm’s ability to generalize across models.
We adapt SemAttack and baseline methods to this setting by performing a transferability-based backbox attack, in which we use adversarial texts created by BERT to attack the target models.
D. Embedding Space Construction
To construct the contextualized semantic perturbation function F C , we select 22 , 271 English words commonly used as X , which is also the vocabulary used by English BERT.
For each word, We select at most 100 sentences that contain this specific word from wikidump.
These contextualized embeddings form an embedding space of 2 , 181 , 622 vectors in total.
We choose k = 700 and ϵ = 8 , which means we only choose words that appear more thantimes in the 700 nearest neighbors as the perturbation set S .
We apply similar strategies when constructing Chinese BERT embedding space, by choosing 5 , 178 Chinese tokens appearing in the training data and up to 100 sentences from Chinese Wikipedia, which form an embedding space of 508 , 619 vectors in total.
When performing KNN, we choose k = 700 and ϵ = 5 .
The query time of
F C is around 2 .
6 s for English and 0 .
9 s for Chinese.
We provide more detailed settings in Appendix E.
D. Semantic Perturbation Functions English
We evaluate the following semantic perturbation functions for English corpus: typo-based perturbation function F T , knowledge-based perturbation function F K , and contextualized semantic perturbation function F C based on BERT embedding clusters, together with the combination of F T ,
F K and F C .
The average sizes of search spaces obtained by F T , F K and F C are 5 .
03 , 2 . 38 and 4 . 46 , respectively.
Chinese
We implement semantic perturbation functions for Chinese corpora as follows: ( 1 ) typobased perturbation function F T , where typos are defined as Chinese characters with similar strokes or pronunciations, ( 2 ) knowledge-based perturbation function F K , where synonyms are obtained from Chinese WordNet, ( 3 ) contextualized semantic perturbation function F C by Chinese BERT embedding clusters, and ( 4 ) the combination of these three functions.
Because in Chinese there are many characters with the same pronunciation, we limit the number of characters obtained by similar pronunciations to 5 .
The average sizes of perturbation search space collected by F T , F K and F C are 8 .
27 and 17 . 06 .
F K gives fewer candidate perturbations because Chinese WordNet has limited hand-crafted knowledge, while F C gives more choices because it searches in BERT embedding space without human supervision.
D. Attack Hyper-parameter Settings
For English dataset, we set the max optimization steps m to 100 and use ℓ 2 norm in the loss function (equation 4) that is iteratively optimized via Adam (Kingma and Ba, 2014).
Constants c and κ are set to 1 e 2 and 1 in Yelp dataset, 1 e 4 and 0 in SNLI dataset, which result in higher attack success rate and lower perturbation rate based on a series of ablation studies provided in Appendix Figure 5.
We set our random seed to 1111 for reproducibility.
For Chinese dataset, we follow the experiment setting in English attacks for optimizing adversarial examples and training BERT models.
Constants c and κ are set to 100 and 1 respectively to get the best performance.
We set our random seed tofor reproducibility.
We experiment with different attack strategies in Appendix Table 11 to 13.
E SemAttack Implementation Details E. Typo-based Perturbation Function Implementation
We use the similar Chinese character list 1 that contains more than 9,000 common Chinese characters.
We use the existing Python library 2 to query the pronunciations for Chinese characters and another library 3 to search for the words that share the same pronunciations.
Because in Chinese there are many characters with the same pronunciation, we limit the number of characters obtained by similar pronunciations to 5 .
E. Knowledge-based Perturbation Function Implementation
In this paper, we use WordNet as an example to illustrate how our framework can integrate the rulebased knowledge to enhance the quality of our adversarial examples.
For an input token x , we first query the synonym set s in the WordNet.
For each meaning of the input word, the output synonym set s contains several synonyms that have this specific meaning.
The output synonyms are given with their corresponding part-of-speech tags.
In order not to include synonyms that have unusual part of speech, which may result in strange grammatical errors after replacement, we counted the frequency at https:// com/
[Figure] [Figure]
of each part of speech in set s
and only selected the words with the highest frequency of part of speech.
Using the synonym set after filtering, we are able to generate adversarial input texts that mislead models’ prediction while having little effect on human understanding [Figure]
F Ablation Studies
F . Perturbation space size selection
In Figure 2, 3, we present the attack success rates and perplexity scores of generated adversarial examples under different sizes of perturbation search space.
We observe that in both languages, larger
K lead to higher attack success rates.
In English,
PPL score decreases when K continues to increase, while in Chinese PPL score remains at a similar level.
F. Attack Efficiency
SemAttack is more efficient than existing baselines since it can substantially decrease the query time when performing attacks.
SemAttack searches for the optimal perturbation e ∗ for a whole sentence in one query, instead of querying every word.
Quantitatively, SemAttack is designed to query the model for less than 100 iterations, while
BERT-ATTACK and TextFooler require hundreds of queries to generate one adversarial example on average.
[Table]
20.1/24.7 BERT-ATTACK 62.8/36.
17.9/18.7 SemAttack (+ F T ) 49.9/33.
26.4/32.9 SemAttack (+ F K ) 40.3/22.
22.1/25.6 SemAttack (+ F C ) 68.9/56.
33.0/39.5 SemAttack (+all) 75.4 / 57.
[Table]
[Figure]
F. BERT Embedding Space
In Figure 4a, we visualize three clusters: “car”, “bird” and “keyboard”.
Here “keyboard” is used as an instrument, not a peripheral device of PCs.
As we can see, ‘bird’ has neighbors such as “pigeons”, “parrot” and “flyer”, which are not present in knowledge space.
Word “keyboard” has neighbors such as “drummer”, “violin” and “guitarist”, which are contextualized based on the query context.
F. Additional Results on Attacking SNLI
We follow the setting of (Li et al., 2020) and perturb only hypotheses or premises for SNLI tasks.
Attack results for perturbing hypotheses are shown in main paper Table 2.
Attack results for perturbing premises only are shown in Table 9 and 10.
F. Ablation Studies on Attack Capability
In this section, we will evaluate the possible factors that will affect the attack success rate.
Here, we set the candidate search space S to be the whole vocabulary V to eliminate variables introduced by the perturbation function
[Table] [Table]
F. Norm selection
In the main experiment
[Table]
we use l 2 norm for our attack loss function (equation 7).
However, because l 1 norm is known for good at feature selection and generating sparse features
[Table]
we conduct the following experiments by setting l p to l 1 and make an comparison with l 2 norm.
The experimental results are shown in Table 11 and 12.
We find the overall attack success rates decrease when switching to lnorm.
However, given the same set of constants c and κ , we find the l 1 attack does change less words.
[Table] [Table]
F. Attack Strategy
As we have achieved 100% attack success rate in the untargeted attack scenario, we now focus on the targeted attack scenario and see which factor contributes to the targeted attack success rate.
It is straightforward to think different targeted attack strategies will impact the targeted attack success rate, because maybe some classes look "farther" than semantic closer classes.
So we tried two strategies on THUCTC dataset: 1) as used in the main paper, we set the targeted false class as “technology news”.
2) we enumerate all the classes and set the targeted false class to be numerically the next class index.
The targeted attack success rate is shown in Table 13.
We do find choosing different attack strategies will impact the attack success rate.
F. Hyper Parameter Selection
We have two constants in our attack algorithm, c and κ , which control the attack success rates and the perturbation rates in our experiments.
In order to find out the impact of these hyper parameters, we test with several combinations of different c and κ .
We test on Yelp Dataset and we use BERT as our model.
We show our results in Figure 5.
As shown in Figure 5a, we first fix κ = 10 and test how
TSR and perturbation rate will change according to different c .
We find that under the same κ , c mainly controls the attack success rate at the cost of perturbation rate.
In some certain range, a larger c encourages the algorithm to achieve our attack goal with the expense of more substitutions.
And
[Figure]
[Figure]
P e r t u r b a t i o n R a t e
TSRPerturbation Rate
[Figure]
TSR change to obtain with less perturbations
A smaller or larger c will result in a low TSR or a high perturba rate.
In Figure 5b after fixing c = test κ = 0 , 1 , while it perturbation rate dramatically.
A after exceeding a certain value, TSR will start to decrease while perturbation rate remains high.
We then fix c = 100 and test different κ .
We show our results in Figure 5b.
We find that κ doesn’t help to increase TSR and a smaller κ helps to limit the words changed without affecting TSR.
For hyper-parameter selection for Chinese datasets, we witness the same phenomenon in English attacks that increasing constant c can improve the attack success rate at the cost of more perturbed characters, while lowering constant κ limits the perturbation rate without affecting the attack success rate.
[Table]
[Table]
F. Vulnerability Between Classes
In THUNews dataset, the article titles are classified into 14 categories.
In order to find out the vulnerability of each class, we test the attack success rate of each source class and target class.
The heatmap of results is provided in Figure 4b.
We find that “technology news” and “entertainment news” as target classes have higher average success rates than other classes, while “lottery ticket” is the lowest.
We also find that “constellation news” has the highest average success rate as source class, while “sports news” has the lowest, which means “constellation news” is vulnerable and easy to attack while “sports news” is much more robust.
F. Transferability Analysis
We evaluate the transferability of adversarial examples between different models by attacking a blackbox BERT classifier by using adversarial text generated from a whitebox LSTM, and vice versa.
The transferability-based attack results on Yelp
Dataset are shown in Table 14.
We find that the robustness of the two models is highly different from each other.
When we feed adversarial texts generated from the LSTM model into the blackbox
BERT model, attack success rate is higher than 70% .
However, when we test the performance of the blackbox LSTM model on adversarial texts generated from the whitebox BERT, attack success rate is around 30% , which is much lower than previous experiment.
These results show that Self-Attention
LSTMs are more robust than BERT models, and the adversarial examples generated from a robust model has higher attack transferability than nonrobust one.
Therefore, we can attack blackbox
BERT models using a strong Self-Attention LSTM trained by ourselves to generate adversarial texts with high success rates.
We also observe that the
USR of transferability-based attack is generally higher than that of targeted attack.
Particularly, we achieve the highest success rate of 81 .
2% when attacking blackbox BERT with text generated by
LSTM attacks under untargeted setting.
Furthermore, we find that the adversarial examples generated by the contextualized semantic perturbation functiuon F C have the highest attack transferability, which suggests that our contextualized semantic perturbation is more generalizable than rule-based perturbation functions.
G Human Evaluation Details Language Quality Evaluation Details
We use
Amazon Turk for English adversarial example quality annotations, and Alibaba Cloud for Chinese example quality annotations.
Each sentence is annotated by 5 annotators.
This evaluation only evaluates language quality and grammatical correctness, and thus does not require additional background or domain knowledge.
We present the annotation instructions on Amazon Turk below.
Please rate the language quality (from 1 to 5, in terms of coherence, fluency, and grammar correctness) of the presented sentence.
5 means the best language quality, and 1 means the lowest language quality.
• 5: The sentence looks totally correct.
There
are no grammatical errors.
I can fully understand the sentence.
• 4: The sentence looks somewhat correct.
There are one or two grammatical errors or typos.
But I can mostly understand the sentence.
• 3: The sentence looks OK to me.
There are some grammatical errors or typos.
I can partly understand the sentence.
• 2: The sentence looks bad to me.
There are grammatical errors or typos everywhere.
I can understand it a little.
• 1: The sentence totally does not make any sense.
I cannot understand it.
Utility Preservation Evaluation Details
We use the targeted SemAttack to generate the adversarial dataset with with c/κ = 100 / 1 .
In total, we collected annotations from 21 graduate students from US universities for English datasets and 26 annotators from native Chinese speakers for Chinese datasets.
Both classification tasks do not require domain knowledge.
The detailed human performance results are shown in Table 6. H
Perturbation Search Space Examples
H.
English Perturbation Search Space S Examples
[Table]
H
Chinese Perturbation Search Space S Examples
[Table]
副
秘 书 长 陈 志 谈 地 产业 诚 信 问 题
Translation: Chen Zhi, Deputy Secretary- General of the Beijing Housing Association, talks about the integrity of the real estate industry
F T ( 长 ) = 氏 , 氐 , 掌 , 涨 , 长 (clan name, foundation, palm, rise, long)
F K ( 长 ) =
长 (general)
F C ( 长 ) = 长 , 授 , 卿 , 员 , 师 , 委 , 厅 , 秘 , 副 , 顾 , 官 , 董 (general, professor, minister, member, teacher, committee, office, secretary, deputy, consultant, official, director)
Input Chinese Text: IMF 大 幅 下 调 明 年 全 球 经 济 增 长 预 期
Translation: IMF sharply lowered its forecast for global economic growth next year
F T ( 长 ) = 氏 , 氐 , 掌 , 涨 , 长 (clan name, foundation, palm, rise, long)
F K ( 长 ) =
长 , 加 , 大 (growth, increase, increase)
F C ( 长 ) = 胀 , 增 , 膨 , 速 , 涨 , 长 , 加 , 快 (swell, increase, inflate, speed, rise, grow, plus, fast)
English Adversarial Examples
[Table]
was charged [Table] 200 to add 6 lbs of Freon to my air conditioning [Table]
went [Table] lbs cost [Table]
[Table]
shipping
[Table]
should be approx [Table] [Table] lbs of Freon
[Table] So labor which was 20 min, transportation, and equipment up - keep for john, the service person who came, was [Table] [Table]
I feel that’s somewhat unreasonable.
Just fair warning for the next customer
[Table] listening to my complaint, the owner offered to refund my payment.
That was quite reasonable of them.
Therefore, I switch my review to 4 stars
[Table]
Adversarial English Text: I was charged $ 200 to ad 6 lbs of Freon to my air conditioning.
I went to amazon.com and 25 lbs cost $ 120 including shipping.
That should be approx $ 29 fog 6 lbs of Freon.
So labor which was 20 min, transportation, and equipment up - keep for john, the service person who came, was $ 171.
I feel that’s somewhat unreasonable.
Just fair warning for the next customer.
Update: after listening to my complaint, the owner offered to refund my payment.
That was quite reasonable of them.
Therefore, I switch my review to 4 stars.
[Table]
Prediction
[Table]
most
[Table]
Original English Text: Liked how they were open late and also had happy hour specials after 10 pm.
We really liked the bulgogi and korean prime kalbi.
They were marinated very flavor-fully .
the mushroom medley and sweet corn were also very good.
Would definitely keep this place on my list of late night eats or when iia just craving korean barbecue.
Adversarial English Text: Lied how they were open late and also had happy hour specials after 10 pm.
We really lied the bulgogi and korean prime kalbi.
They were marinated very flavor-fully .
the mushroom medley and sweet corn were also very good.
Would definitely keep this place on my list of late night eats or when iia just craving korean barbecue.
Model Prediction: [Table]
[Table]
most
[Table] [Table]
Original English
[Table]
: My 2017 camry got a check engine light and my car had a strong odor of gasoline after service closed, I asked the receptionist if there was anyway they could get me a rental
and she said they were closed so she recommended me to come in bright and early at 7am on monday so they could look at my car
so I told her I left for work at 6am cause I work in north scottsdale
so I told her I didn’t not want to drive my car to scottsdale and back because I was afraid my car would blow up or something from the strong odor of gasoline and she put me on hold to talk to a manager.
When she came back on the phone she said her manager was going to get a hold of the rental manager to see if someone could come in tomorrow ( today now ) to get me a rental
and I left my name and number and no one has reached out to me.
It’s great to know they don’t care if their customer’s car blows up on the freeway cause it’s not a sale!
Thanks avondale toyota you guys rock ! ! ! !
The dealership I work at teaches their receptionist to hand out rentals cause they know stuff like this happens, you guys might want to look into that !
Adversarial English Text:
My 2017 camry got a check engine light and my car had a strong odor of gasoline after service closed, I asked the receptionist if there was anyway they could get me a rental
and she said they were closed so she recommended me to come in bright and early at 7am on monday so they could look at my car
so I told her I left for work at 6am cause I work in north scottsdale
so I told her I didn’t not want to drive my car to scottsdale and back because I was afraid my car would blow up or something from the strong odor of gasoline and she put me on hold to talk to a manager.
When she came back on the phone she said her manager was going to get a hold of the rental manager to see if someone could come in tomorrow ( today now ) to get me a rental
and I left my name and number and no one has achieve out to me.
It’s great to know they don’t care if their customer’s car blows up on the freeway cause it’s not a sale!
Thanks avondale toyota you guys rock ! ! ! !
The dealership I work at teaches their receptionist to hand out rentals cause they know stuff like this happens, you guys might want to look into that ! Model [Table] [Table]
star (most
[Table] → [Table] (most positive)
Original English Text: I called numerous times and noted that they are going to deliver at a work address between 9 am to 5 pm.
They attempted delivery three times after 5 pm.
I got up to pick up my parcel and got it delivered on time .
Adversarial English Text: I called numerous times and noted that they are going to deliver at a work address between 9 am to 5 pm.
They attempted delivery three meter after 5 pm.
I got up to pick up my parcel and got it delivered on time .
[Table] [Table]
odor of
[Table]
, I asked the receptionist if there was anyway they could get me a rental
and she said they were closed so she recommended me to come in bright and early at 7am on monday so they could look at my car
so I told her I left for work at 6am cause I work in north scottsdale
so I told her I didn’t not want to drive my car to scottsdale and back because I was afraid my car would blow up or something from the strong odor of gasoline and she put me on hold to talk to a manager.
When she came back on the phone she said her manager was going to get a hold of the rental manager to see if someone could come in tomorrow ( today now ) to get me a
[Table]
and I left my
[Table]
and
[Table]
and no [Table] has reached out to me.
It’s great to know they don’t
[Table]
if
[Table]
the
[Table]
not
[Table]
happens
[Table]
if there was anyway they could get me
[Table]
said they were
[Table]
so
[Table] in bright and early at 7am on monday so they could look at my car so I told her I left for work at 6am cause I work in north scottsdale so I told her I didn’t not want to drive my car to scottsdale and back because I was worry my car would blow up or something from the strong odor of gasoline and she put me on hold to talk to a manager.
When she came back on the phone she said her manager was going to get a hold of the rental manager to see if someone could come in tomorrow ( today now ) to get me a rental
and I left my name and number and no one has reached out to me.
It’s great to know they don’t care if their customer’s car blows up on the freeway cause it’s not a sale !
Thanks avondale toyota you guys rock ! ! ! !
the dealership I work at teaches their receptionist to hand out rentals cause they know stuff like this happens, you guys might want to look into that !
[Table]
Original English Text: I have used this company twice.
The first time they were great.
We spent over 5,000 for installation of a new ac unit on a rental property.
Since they did an excellent job, we had them do a redesign of ac system in our home to improve the cooling in our house.
It was one of the most frustrating customer service experiences I’ve had with a contractor in the 25 years I have lived in phoenix.
They didn’t complete the job in the time frame they promised.
They damaged the faux ceiling in the kitchen, they drilled holes and didn’t repair them in the bedroom.
They left marks on the ceiling in the living room, where they marked to cut a hole and then didn’t.
Which told me they installers were not skilled or professional.
After waiting for 2 months for them to repair the mistake in the kitchen, we gave up and paid to have it repaired.
I heard a lot of promises, no solution.
I would never use this contractor again.
Adversarial English Text: I have used this company twice.
The first time they were great.
We spent over 5,000 for installation of a new ac unit on a rental property.
Since they did an exemplary job, we had them do a redesign of ac system in our home to improve the cooling in our house.
It was one of the most frustrating customer service experiences I’ve had with a contractor in the 25 years I have lived in phoenix.
They didn’t complete the job in the time frame they promised.
They damaged the faux ceiling in the kitchen, they drilled holes and didn’t repair them in the bedroom.
They left marks on the ceiling in the attic room, where they marked to cut a hole and then didn’t.
Which told me they installers were not skilled or professional.
After waiting for 2 months for them to repair the mistake in the kitchen, we gave up and paid to have it repaired.
I heard a lot of promises, no solution.
I would never use this contractor again.
[Table]
[Table]
at buffalo exchange
but when it comes to selling I prefer selling to the phoenix location because the employees are a lot more genuine, there’s less of a hipster pretentious vibe there, and I usually sell more there anyway.
Not to mention the tempe location usually turns the music off at 8:30, which gives an unwanted feeling to their guests.
I am giving two stars for the sake of finding things at all locations.
Go phoenix location!
Model Prediction: 2-star (negative) → 5-star (most positive)
Original English Text: There’ s so many choices of food in Las Vegas.
Don’t choose this place.
It is no exaggeration that mcdonalds and arby’s have better hash browns, eggs, and bacon.
Missed items in the dishes we ordered.
All around disappointment to the Las Vegas allure.
Adversarial English Text: There’s so many choices of food in Las Vegas.
Don’t choose this place.
It is no exaggeration that mcdonalds and arby’s have delicious hash browns, eggs, and bacon.
Missed items in the dishes we ordered.
All around disappointment to the Las Vegas allure.
Model Prediction: 1-star (most negative) → 5-star (most positive)
Original English Text: Not only is this place in my neighborhood, it is exactly what I’m looking for.
I have pale skin, green eyes, and freckles yet I have been cheated out of having naturally red hair by mother nature!!
Therefore I have been a fake redhead for at least a decade.
You can imagine the cost and damage to my hair I have endured.
Fringe has a new dye that is ammonia free!
It’s basically just a oil and water dying process!
I’ve gone twice in a row and my hair has never been in such good condition.
I’m paying the same amount for hair dying as my old salon except here I get a better cut and style and it’s not frying my hair!
Also Chanel (who dyes my hair) is a totally cool chic and always has interesting things to talk about!
This is my new go to salon!
Adversarial English Text: Not only is this place in my neighborhood, it is exactly what I’m looking for.
I have pale skin, green eyes, and freckles yet I have been humiliated out of having naturally red hair by mother nature!!
Therefore I have been a fake redhead for at least a decade.
You can imagine the cost and damage to my hair I have endured.
Fringe has a new dye that is ammonia free!
It’s basically just a oil and water dying process!
I’ve gone twice in a row and my hair has never been in such good condition.
I’m paying the same amount for hair dying as my old salon except here I get a better cut and style and it’s not frying my hair!
Also
Chanel (who dyes my hair) is a totally cool chic and always has interesting things to talk about!
This is my new go to salon!
[Table]
[Table]
H.
Chinese Adversarial Examples
[Table]
[Table]
[Table]
[Table]
[Table]
) was established on March 29, 2012.
Headquartered in the capital, Beijing, the company is registered with the
National Development and Reform Commission, and is a legal financial institution that is issued a financial license by the Securities Investment Fund Association of China.
[Table]
Translation: Shenrong Huachuang (Beijing) Fund Co., Ltd. (abbreviated as Zhongrong Huachuang) was established on March 29, 2012.
Headquartered in the capital, Beijing, the company is registered with the
National Development and Reform Commission, and is a legal financial institution that is issued a financial license by the Securities Investment Fund Association of China.
[Table]
Original Chinese
[Table]
[Table]
行
[Table]
[Table] [Table] [Table] 手
[Table] 高 手 ， [Table] Translation: The futures industry is surging, and the futures market is familiar with ever-changing conditions.
Trading helps fun trading, and join hands with many futures experts to make trading easier!
Adversarial Chinese
[Table]
[Table]
[Table]
手
[Table]
货 高
[Table]
Translation: The futures bond industry is surging, and the futures market is familiar with ever-changing conditions.
Trading helps fun trading, and join hands with many futures experts to make trading easier!
Model Prediction: Futures （
[Table]
Comprehensive
[Table]
Original Chinese
[Table]
[Table]
本
[Table]
Translation: Rui ni Capital focuses on equity investment, securities investment and derivatives research and other fields. Its business covers primary and secondary markets, including angel investment and hedging, equity and fixed income securities investment.
[Table]
[Table]
and derivatives research and other fields.
Its business covers primary and secondary markets, including angel investment and hedging,
[Table]
and
[Table]
securities investment.
[Table]