Adv- OLM : Generating Textual Adversaries via OLM (2021)

Abstract: Deep learning models are susceptible to adversarial examples that have imperceptible perturbations in the original input, resulting in adversarial attacks against these models. Analysis of these attacks on the state of the art transformers in NLP can help improve the robustness of these models against such adversarial inputs. In this paper, we present Adv-OLM, a black-box attack method that adapts the idea of Occlusion and Language Models (OLM) to the current state of the art attack methods. OLM is used to rank words of a sentence, which are later substituted using word replacement strategies. We experimentally show that our approach outperforms other attack methods for several text classification tasks.

## introduction in recent times, deep learning models have become pervasive across different domains. many of the recent deep models have shown sota performance on a variety of nlp tasks @xcite . consequently, deep models are being deployed in a variety of production systems for real-life applications. hence, it becomes imperative to ensure the reliability and robustness of such models as it might pose a threat to security. recent studies have pointed out the vulnerability of deep models to adversarial attacks @xcite . adversarial attack comprises generating adversarial samples by performing small perturbations to the original input, making them imperceptible to humans while fooling the deep learning models to give incorrect predictions. adversarial attack on textual data is much more difficult due to the discrete nature of the text. the basic requirement of imperceptibility of perturbation by human judges is much more challenging in a language data setting. therefore, the adversarial sample needs to be grammatically correct and semantically sound. perturbations at word or character level that are perceptible to human judges have been explored in-depth @xcite @xcite . work on defense against misspellings based attacks @xcite and use of optimization algorithms for attacks like genetic algorithm @xcite and particle swarm optimization @xcite have also been explored. with the rise of pre-trained language models, like bert @xcite and other transformer-based models, generating human imperceptible adversarial examples has become more challenging. wallace et al. (2019 adversarial examples can be generated using black-box, where no knowledge about the model is accessible, and white-box, where information about the technical details of models are known. generation of textual adversarial samples in a black-box setting consists of two steps 1) finding words to replace in a sample (word ranking) 2) replacing the chosen word (word replacement). word ranking is necessary to ensure that the word that contributes the most to the output prediction is considered as the candidate for replacement in the next step. other constraints like generating semantically similar adversarial samples, human imperceptibility, and minimal perturbation percentage are also considered. previous work has obtained word ranking by performing deletion of words (e.g., bae-r (garg and ramakrishnan, 2020), textfooler @xcite ), and replacement of words with [unk] token (e.g., bert-attack @xcite ) and then ranking the words based on the output logits difference. recently in the model explainability domain, the method of occlusion and language models (olm) @xcite has been proposed, the authors argue that the data likelihood of the samples obtained after either deleting the token or replacement with [unk] token is very low, which makes these methods unsuitable for determining relevance of the word towards the output probability. the authors propose the use of language models for calculating the relevance of the words in a sentence. taking inspiration from olm, we propose adv-olm, a black box attack method, that adapts the idea of olm (as the work ranking strategy) to find the relevant words to replace. we empirically show that olm provides a better set of ranked words compared to the existing word ranking strategies for the generation of adversarial examples. we summarize our contributions as follows: ## problem formulation we are given a corpus consisting of n input samples, @xmath0, . . . , x n } with corresponding labels @xmath1, . . . , y n } and a trained classification model f (f : @xmath2. we assume a black-box setting where the attacker can only query the classifier for output label probabilities for the given input. for an input sample @xmath3, the task is to construct an adversarial sample x such that, f (x) = y, f (x ) = y with @xmath4, and similarity(x , x) ≥ . here, similarity : x × @xmath5, 1) can be both the semantic and syntactic similarity function, and is the minimum similarity threshold. ideally, the amount of perturbation should be minimized. the first step is to rank the words of the sample x. based on the ranking, starting from the most important word, the word is replaced by some candidate word that keeps the perturbed sample x semantically similar and grammatically sound but changes the output prediction. ## methodology adv-olm uses the idea of occlusion and language models to perform word ranking using both olm and olm-s methods. olm uses a language model to sample some candidate instances for a word and then replaces the word. let x i be a word of the input x and x \i be the incomplete input without this word. then the olm relevance score r given the prediction function f and label y is (here f y is the logit value corresponding to the label y.) r f,y ( here, f y (x \i ) is not accurately defined and needs to be approximated since x \i is the incomplete input. a language model p lm generates input by predicting the masked word as xi that is as natural as possible for the model and thus approximates to: the other method olm-s calculates the sensitivity of a position in the text and has nothing to do with the word present at that position in the original input. the sensitivity score of olm-s is calculated ## experiments we replaced the existing word ranking strategies (i.e. original (delete)) of previous attack methods: textfooler @xcite and bae-r (garg and ramakrishnan, 2020) with word rankings generated using olm and olm-s while keeping rest of the attack procedure same. the ## results and analysis results are shown in tables 2, 3 and 4. to compare attacks across different transformerbased models, we evaluate the performance of adv-olm on imdb dataset. experimentally it was observed that better words were ranked when olm/olm-s was used as the word ranking strategy (figure 1b ). when comparing with the original methods, adv-olm has more number of queries, which is due to the fact that for word rankings, olm/olm-s queries the model a number of times, thus increasing the overall queries. however, the difference in the number of adv-olm queries with the existing attacking methods is not very significant since the model is queried only for unique words from the samples generated from the language model. ## conclusion in this work, we present adv-olm, a black box attacking method that uses olm based word ranking strategy, improving the attack performance significantly over previous methods. we also studied how replacing a single variable in a complex system with a new existing method can improve upon the previously existing attack strategies. for future work, we would like to experiment with other language models in the olm algorithm. we plan to study the effect of using different transformers for the language model and the target model. textattack builds attacks from four components: for our approach, we attack textattack's finetuned models on datasets discussed in a, that are publically available on huggingface foot_1 textattack is also used for the execution of all the previous attacking methods and our adv-olm as well.