Smart Lexical Search for Label Flipping Adversial Attack (2024)

Abstract: Language models are susceptible to vulnerability through adversarial attacks, using manipulations of the input data to disrupt their performance. Accordingly, it represents a cibersecurity leak. Data manipulations are intended to be unidentifiable by the learning model and by humans, small changes can disturb the final label of a classification task. Hence, we propose a novel attack built upon explainability methods to identify the salient lexical units to alter in order to flip the classification label. We asses our proposal on a disinformation dataset, and we show that our attack reaches high balance among stealthiness and efficiency.

## introduction adversarial attacks exploit the weaknesses of victim models through modifications in the model architecture or input data to change their efficiency. these attacks are more dangerous if both the model and the human eye are not able to identify them, using techniques of imperceptible characters or small modifications @xcite . adversarial attacks may focus on decreasing the effectiveness or performance of the victim model depending on their approach. there can be targeted attacks, focused on label flipping, or untargeted attacks that base their strategy on decreasing its performance. in this work, we have performed label flipping inference attacks, using different attacks focusing on the use of different search spaces and stealthy modifications adapted to a real environment. we study two search strategies, one based on an iterative search and the other focused on finding, through using the post-hoc explainability method shap @xcite , the most important words to modify and change the model label using a few search resources. as a result of this study, we propose an attack that combine the two search algorithms to increase the efficiency of the attack, making it stealthier in more realistic environments. we call this joint attack hybrid keytoken attack. to evaluate the robustness of the victim model, and the stealthiness of the attack, we need metrics adapted to these cases. the bodega framework @xcite provides semantic similarity, levenshtein distance, and the success of changing the target text label. we use a disinformation dataset with which the model victim robertabase @xcite is trained for this task. this language model will be a victim of character, word, and word embedding attacks. this work performs a system study that uses explainability and an iterative search to flip the label of a victim model. using a different search space to find the best perturbation, a search space is a series of modifications and constraints to achieve a goal. the hybrid keytoken attack achieves a similar result than the brute force but in much less time, being more efficient and harder to detect in a real case. furthermore, we compare the hybrid keytokens attack with state-of-the-art baseline algorithms in the context of adversarial attacks. the rest of the paper is organized as follows: section 2 presents the context and the works that support our proposal. section 3 details the targeting of adversary attacks and the types of attacks carried out in this work. it also explains the search spaces used as well as our novel hybrid attack. section 4 presents the experimental framework. section 5 analyse the results obtained and finally section 6 determines conclusions and discusses the future works. these security issues have also been transferred to the domain of natural language processing (nlp). common security vulnerabilities often have defined structures and patterns. these can be detected in real time when bad actors have already exploited them. techniques exist to detect these problems, but they are not robust @xcite . that is why it is important to know the attacks well to create a solution in a specific domain, as in nlp @xcite . following a review of @xcite , vulnerabilities of learning models can be attacked in the training and testing stage. in training, they can be divided into data injection, data modification, and logical corruption. these attacks in the training stage are carried out in three ways: in the test stage, they can access the victim model to obtain specific information. with this information they can attack the model by a whitebox and black-box attack approaches. in recent years, vulnerabilities have also been discovered in language models, creating adversarial attacks designed specifically for nlp tasks. adversarial attacks are manipulations applied to any input data supplied to a model. these attacks are designed to be imperceptible to a human review and to a trained model, when processing the data already modified by the attack, it causes the model to make an error in its classification @xcite . these attacks can take various forms, such as substitution, insertion, deletion, and exchange of words/characters in a sentence or in the neighboring words of a target word to introduce disruption. there are two types of adversarial attacks, blackbox or white-box, based on the attacker's access to the model parameters @xcite . the manipulations mentioned above, such as character-level attacks, can result in misspelled words that spellcheckers can easily detect. due to the superiority of the word-level attack @xcite , (e.g. bert-attack or pww) a comparison of character-level manipulations with these word-level attacks be made in this work. ## keytoken adversarial attacks we introduce in this section the types of search algorithms that are the backbone of the attacks assessed in this work, explaining how they work and which heuristics of each of them are used in the experiments. in the following subsections, we define how the text parts of a sentence to be modified are selected, explaining a method that focuses its search on explainability using the shap method (see section 3.1.1), and another one that uses an iterative method that does not take into account the execution time and its only objective is to change the label of the victim model. finally, we propose a hybrid system able to use the advantages of the defined heuristics to obtain good performance and to be difficult to identify. perturbing a text input with linguistic modifications, such as substitutions or misspellings to damage an nlp model, while respecting certain restrictions, such as semantic similarity, is defined as search space @xcite . we used the malicious modifications proposed in @xcite , for our targeted attacks focused on flipping the classification label. in particular, we use the following search algorithms: search space our modifications to the search space are each of a type of heuristic named above, at the character, word, and insertion level. the search space perturbations are focused on obtaining a high semantic similarity and a minimum levenstein distance of the target sentence. the perturbations performed are indicated bellow: the synonym selected to replace the target word will be the one with the farthest similarity, to try to change the label objective, but trying not to change the meaning of the sentence. in any case as a restriction, if the selected word is a single-character word, it will be deleted. as well as if a word cannot be substituted effectively (e.g. it cannot find a synonym for the target). figure 1 shows an example of each type of attack. in the case of the insertion of an invisible character, the character shown would not be visible, however we have added it in figure 1 for the sake of clarity. in the following subsections, we define the search methods and the algorithms used. smart keytokens attacks uses a search algorithm focused on finding the most important words in the input text using shap (lundberg and lee, 2017). in contrast, a brute force search will also be performed using the same modifications as the other search space. ## experimental framework and results we use the bodega framework to evaluate our attacks according to a specific evaluation measure that takes into account the effectiveness of the attack and its stealthiness. likewise, the evaluation measure of bodega is defined to evaluate the robustness of classifiers against adversarial attacks by measuring the eligibility of changes made to perturb the output of the victim model. additionally, the bodega framework provides the victim model, roberta-base, trained with the disinformation dataset selected for this task. ## result analysis the keytokens attacks performed do not succeed very well in flipping the label of the victim model roberta-base. although, it can be noted that the homoglyphs obtain a high semantic and character score. all these types of attacks take an average of 14 seconds to execute but taking into account the number of queries made to the victim model, the homoglyphs are the best performers in these experiments using the keytokens search method. analysing the non-keytokens attacks it can be differentiated that techniques using brute force are always more successful. on the other hand, homoglyphs are more successful in all metrics, whether they use brute force or not. these attacks, especially brute force attacks, have a very high computational and query time, as they use much more computationally expensive search methods. in our proposal hybrid attack, we used the technique that has given the best results and shap. we obtained results similar to the best results obtained with brute force attacks but using much less computation time and queries to the model. this means, we sacrifice success for efficiency, and in a real case, it would be much harder to detect. using techniques such as adding words as invisible characters or changing words into synonyms has obtained very similar results. our proposed system obtains the best results in a real attack environment. it obtains a success rate of 70% and is almost imperceptible to the human eye and the victim model, in this case, roberta-base. after obtaining a system with a lower success rate but with a significant improvement in the time and number of queries to the victim model, a comparison is performed with the algorithms provided by bodega to attack with adversarial attacks using the same dataset under the same conditions and metrics. our hybrid system obtains a higher bodega score than all the algorithms provided by the framework for use as adversarial attacks, in this case, the model that had not been evaluated in bodega, roberta-large. the hybrid keytoken attacks stand out for being stealthy and making few queries to the victim model, moreover, except for out-layer cases, the average time per execution is much lower than the second-best result bert-attack. ## conclusion and future work we perform 3 different heuristics to make the adversarial attacks of this work, homoglyphs, invisible characters, and the use of synonyms. we observed that homoglyphs have a better ratio in both success and stealth. this is because it only changes one letter of the attacked text and that it does not remove almost any semantic meaning from the sentence. non-smart keytoken attacks using brute force give better results. the brute-force homoglyphs obtain remarkable results compared to the other experiments, but in contrast, it uses a lot of time and queries to the victim model, which makes it easy to detect in a real context. hybrid keytoken attacks reach a balance between disrupting model output, stealth, and queries to the victim model. it also performs better than the algorithms offered by the bodega framework in its literature. therefore, we can conclude that our hybrid model that uses shap-based search spaces to find the most important tokens of a sentence, using as support a greedy system that stores in memory the modifications previously made to the sentence, obtains good, stealthy and difficult to detect results in a real environment, where the execution time and the requests to the victim model are essential. our proposal needs several attacking shots to be successful. hence, a system can be defend attending to the number of consecutive shots regarding a similar input text. an additional defense method may be built upon a machine translation method, since this methods are less vulnerable to characterlevel modifications like homoglyphs. as future work, it would also be interesting to create a real-time defense capable of identifying these disturbances, either by execution time or by prior analysis of the input data, and in case of detection, to return the input data to its original state.