TRA ttack: Text Rewriting Attack Against Text Retrieval (2022)

Abstract: Text retrieval has been widely-used in many online applications to help users find relevant information from a text collection. In this paper, we study a new attack scenario against text retrieval to evaluate its robustness to adversarial attacks under the black-box setting, in which attackers want their own texts to always get high relevance scores with different users’ input queries and thus be retrieved frequently and can receive large amounts of impressions for profits. Considering that most current attack methods only simply follow certain fixed optimization rules, we propose a novel text rewriting attack (TRAttack) method with learning ability from the multi-armed bandit mechanism. Extensive experiments conducted on simulated victim environments demonstrate that TRAttack can yield texts that have higher relevance scores with different given users’ queries than those generated by current state-of-the-art attack methods. We also evaluate TRAttack on Tencent Cloud’s and Baidu Cloud’s commercially-available text retrieval APIs, and the rewritten adversarial texts successfully get high relevance scores with different user queries, which shows the practical potential of our method and the risk of text retrieval systems.

## introduction text retrieval is a popular and important technology for solving information explosion. in many commercial systems, such as baidu knows 1 , answer 2 and stackexchange 3 , text retrieval is the key to find relevant content and help search engines to return the information that users want @xcite . with the development of deep neural networks, many deep learning-based models @xcite @xcite are proposed for measuring text 1 https://zhidao.baidu.com/ 2 https://www.answers.com/ 3 https://stackexchange.com/ user input queries ori. adv. ## text rewriting attack in this section, we first formally define the new attack problem against text retrieval under the blackbox setting and then introduce the details of our proposed text rewriting attack method. ## conclusion in this paper, we discuss a new realistic attack problem against text retrieval. we follow the word replacement framework and propose trattack. extensive experiments show that benefiting from the the learning ability of mab, trattack achieves better performance than existing methods. the generated adversarial texts by trattack can successfully mislead both offline text retrieval models and online commercial apis, which demonstrates the potential risks of real-world text retrieval systems.