Adaptive Immune-based Sound-Shape Code Substitution for Adversarial C hinese Text Attacks (2024)

Abstract: Adversarial textual examples reveal the vulnerability of natural language processing (NLP) models. Most existing text attack methods are designed for English text, while the robust implementation of the second popular language, i.e., Chinese with 1 billion users, is greatly underestimated. Although several Chinese attack methods have been presented, they either directly transfer from English attacks or adopt simple greedy search to optimize the attack priority, usually leading to unnatural sentences. To address these issues, we propose an adaptive Immune-based Sound-Shape Code (ISSC) algorithm for adversarial Chinese text attacks. Firstly, we leverage the Sound-Shape code to generate natural substitutions, which comprehensively integrate multiple Chinese features. Secondly, we employ adaptive immune algorithm (IA) to determine the replacement order, which can reduce the duplication of population to improve the search ability. Extensive experimental results validate the superiority of our ISSC in producing high-quality Chinese adversarial texts. Our code and data can be found in https://github.com/nohuma/chinese-attack-issc.

## introduction deep neural networks (dnns) have shown great vulnerability towards text adversarial examples, primarily in english text @xcite . this phenomenon poses a great challenge for the security application of dnns models in text-related tasks, such as sentiment analysis @xcite and toxic comment detection @xcite , etc. therefore, it is essential to devise high quality text adversarial examples to investigate the brittleness boundary and understand the behaviors of modern dnns models before implementation. during the past decade, abundant attention has been paid to craft english text adversarial examples, ranging from character-level attack @xcite , word-level attack @xcite , sentence-level attack @xcite , and multi-level attack @xcite , usually with text insertion, deletion, substitution, and rewriting operations. owing to the concealment and flexibility, word substitution based text attack methods are gradually becoming the most popular line @xcite . in this line, two common steps are (1) generating high quality substitution candidates, and (2) optimizing the attack priority. to generate semantic consistency candidates, researchers have tried glove embedding, wordnet synonyms, hownet sememe candidates, masked language models (mlm), and prompt engineering. in the second step, various optimization methods, e.g., word-saliency based static optimization @xcite @xcite , and objective guided dynamic heuristic optimization @xcite , have been widely explored. ## related works in this section, we briefly review the text adversarial attacks in both english and chinese. ## methodology in this section, we first define the text adversarial attack problem in § 3.1, then we discuss the sound-shape code (ssc) and immuse algorithm (ia) in § 3.2 and § 3.3, respectively.