A Classification-Guided Approach for Adversarial Attacks against Neural Machine Translation (2024)

Abstract: Neural Machine Translation (NMT) models have been shown to be vulnerable to adversarial attacks, wherein carefully crafted perturbations of the input can mislead the target model. In this paper, we introduce ACT, a novel adversarial attack framework against NMT systems guided by a classifier. In our attack, the adversary aims to craft meaning-preserving adversarial examples whose translations in the target language by the NMT model belong to a different class than the original translations. Unlike previous attacks, our new approach has a more substantial effect on the translation by altering the overall meaning, which then leads to a different class determined by an oracle classifier. To evaluate the robustness of NMT models to our attack, we propose enhancements to existing black-box word-replacement-based attacks by incorporating output translations of the target NMT model and the output logits of a classifier within the attack process. Extensive experiments, including a comparison with existing untargeted attacks, show that our attack is considerably more successful in altering the class of the output translation and has more effect on the translation. This new paradigm can reveal the vulnerabilities of NMT systems by focusing on the class of translation rather than the mere translation quality as studied traditionally.

## introduction recently, deep neural networks have emerged as powerful tools in various domains, such as natural language processing (nlp) @xcite and computer vision @xcite . despite their exceptional performance, these models have been shown to be susceptible to slight perturbations to their inputs, known as adversarial attacks @xcite @xcite . in particular, adversarial examples closely resemble the original input and can deceive the target model to generate incorrect outputs. ex-tensive research has also been devoted to adversarial attacks against nlp models @xcite @xcite @xcite since nlp models are increasingly employed in practical systems. these studies have mainly focused on text classification tasks such as sentiment classification and natural language inference. in text classification, the adversary aims to fool the target model into misclassifying the input sentence as a specific wrong class (targeted attacks) or any class other than the correct ground-truth class (untargeted attacks). another important task in nlp is neural machine translation (nmt), which has gained significant attention @xcite . in this application also, adversarial attacks have been studied to gain insights into the vulnerabilities of these systems. particularly, untargeted attacks seek to generate adversarial examples that preserve the semantics in the source language while the output translation by the target model is far from the true translation @xcite @xcite @xcite . on the other hand, targeted attacks against nmt systems aim to mute or push specific target words in the translation @xcite @xcite . none of these attacks against nmt systems actually consider the class of the output translation as the objective of the adversarial attack. however, in some cases, the user only cares about the class, e.g., sentiment, of the translation rather than the exact translation. moreover, the class of the translation reflects the whole meaning of the sentence. nevertheless, simply reducing the translation quality (untargeted attacks) or inserting specific keywords in the translation (targeted attacks), as proposed in previous works, may not sufficiently alter the translation and thus change the overall category of the translation. moreover, in previous attack frameworks, it is par- input text (@xmath0. unflinchingly bleak and desperate inébranlablement sombre et désespéré neg. neg. adv. act tf unflinchingly bleak and upsetting légère et bouleversante, sans fin pos. pos. (light and moving, endless) adv. tf unflinchingly melancholy and upsetting mélancolie et bouleversement inébranlables pos. neg. (unwaveringly melancholy and turmoil) in light of the above challenges, this paper introduces act (altering class of translation), a novel adversarial attack framework against nmt systems guided by a classification objective. in our attack strategy, the adversary aims to craft an adversarial example in the source language that deceives the target nmt model. specifically, the goal is to make the translation of the adversarial sentence belong to a different class than the original translation. to achieve this, the adversary uses an arbitrary classifier as an oracle to predict and alter the class of the output translation by the target nmt model. by targeting the class of the output translation, our attack has a more substantial effect on the translation. the second row of we extensively evaluate the robustness of nmt systems to our proposed attack. to evaluate the attack, we measure the success rate of altering the class of the output translation by using a classifier that was not involved in the attack process. moreover, we estimate the impact of the attack on the nmt model by the similarity between the translations of the original and adversarial sentences. as a baseline, we consider the untargeted attacks against nmt systems and check if the class of the translation changes after the attack. our experiments show that, although untargeted attacks can reduce the translation quality, they are notably less successful in changing the category of the translation. in contrast, our proposed attack not only changes the class of the translation but also has more impact on the translation. it shows that our new attack can provide a more comprehensive evaluation of the robustness of nmt systems to adversarial attacks. in summary, our contributions are as follows: ## related works textual adversarial attacks pose unique challenges compared to their image domain counterparts. the discrete nature of textual data makes it challenging to employ gradient-based optimization methods directly. moreover, defining the imperceptibility of adversarial perturbations for text is difficult. while a significant portion of research has focused on text classification, some works also target sequence-tosequence nlp systems, such as nmt. ## act attack framework against nmt in this section, we introduce act, our new attack framework against nmt models. then, we present our method to craft such adversarial examples. ## experiments in this section, we discuss our experimental setup, and then we conduct comprehensive experiments to evaluate the robustness of various nmt models and tasks in the face of our proposed attack strategy. foot_2 ## human evaluation we conduct a human evaluation campaign for the successful adversarial examples generated by act tf against marian nmt (en-fr). we randomly choose 80 successful adversarial examples on the sst-2 dataset. we split these sentences into two surveys and recruit three volunteer annotators for each survey. since the adversarial examples are in french, we ensure that the annotators are native (mother tongue) or highly proficient in french. since the naturalness and sentiment accuracy of textfooler and bae are already evaluated by human in their respective papers, we do not consider these two aspects of the adversarial examples in our evaluation. instead, we study the sentiment of the adversarial translations in the target language (french). by showing the adversarial translations, we ask the annotators to choose a sentiment label from "positive" and "negative". we take the majority class as the predicted label for each sentence. in our attack framework, the target of the attack is the nmt model, and the adversary uses a classifier to change the class of the translation. therefore, we want the proposed attack mainly affect the nmt model rather than the classifier. accordingly, in this study, we evaluate how much the classifier is influenced by the attack. the overall agreement between the ground-truth labels (in the dataset) and the labels predicted by the annotators is 71.3%. while it's true that not all adversarial translations are accurately classified by the classifier based on the annotators' labels, the majority of adversarial translations have the same sentiment as predicted by the classifier. this implies that the attack is mainly targeting the nmt model rather than fooling the classifier. moreover, we calculate the similarity between original and adversarial translations in terms of chrf for the sentences selected for human evaluation. for sentences that the classifier's predictions align with the annotators' labels, the translation similarity is 49.46. in contrast, for sentences that the classifier's predictions diverge from the annotators' labels, the translation similarity is 52.05. this difference highlights that the attack is mainly affecting the nmt model rather than the classifier for the adversarial sentences whose translation deviates more from the original translation. ## conclusion in this paper, we presented act, a novel adversarial attack framework against nmt models that is guided by a classifier. in our framework, the adversary aims to alter the class of the output translation in the target language while preserving semantics in the source language. by targeting the class of the output translation, we outlined a new aspect of vulnerabilities of nmt models. we proposed enhancements to existing black-box wordreplacement-based attacks to evaluate the robustness of nmt models to our attack strategy. extensive experiments and comparisons with existing untargeted attacks against nmt models showed that our attack is highly successful in changing the class of the adversarial translation. it also has more impact on the similarity of the original and adversarial translations, which highlights the potential impact of our attack strategy on the overall meaning of the nmt output translations.