BAE : BERT -based Adversarial Examples for Text Classification (2020)

Abstract: Modern text classification models are susceptible to adversarial examples, perturbed versions of the original text indiscernible by humans which get misclassified by the model. Recent works in NLP use rule-based synonym replacement strategies to generate adversarial examples. These strategies can lead to out-of-context and unnaturally complex token replacements, which are easily identifiable by humans. We present BAE, a black box attack for generating adversarial examples using contextual perturbations from a BERT masked language model. BAE replaces and inserts tokens in the original text by masking a portion of the text and leveraging the BERT-MLM to generate alternatives for the masked tokens. Through automatic and human evaluations, we show that BAE performs a stronger attack, in addition to generating adversarial examples with improved grammaticality and semantic coherence as compared to prior work.

## introduction recent studies have exposed the vulnerability of ml models to adversarial attacks, small input perturbations which lead to misclassification by the model. adversarial example generation in nlp @xcite is more challenging than in commonly studied computer vision tasks @xcite @xcite because of (i) the discrete nature of the input space and (ii) the need to ensure semantic coherence with the original text. a major bottleneck in applying gradient based @xcite or generator model @xcite based approaches to generate adversarial examples in nlp is the backward propagation of the perturbations from the continuous embedding space to the discrete token space. initial works for attacking text models relied on introducing errors at the character level @xcite or adding and deleting words @xcite @xcite for creating adversarial examples. these techniques often result in unnatural looking adversarial examples which lack grammatical correctness, thereby being easily identifiable by humans. rule-based synonym replacement strategies @xcite have recently lead to more natural looking adversarial examples. @xcite combine both these works by proposing textfooler, a strong black-box attack baseline for text classification models. however, the adversarial examples generated by textfooler solely account for the token level similarity via word embeddings, and not the overall sentence semantics. this can lead to out-of-context and unnaturally complex replacements (see therefore, a token replacement strategy contingent on retaining sentence semantics using a pow-erful language model @xcite can alleviate the errors made by existing techniques for homonyms (tokens having multiple meanings). in this paper, we present bae (bert-based adversarial examples), a novel technique using the bert masked language model (mlm) for word replacements to better fit the overall context of the english language. in addition to replacing words, we also propose inserting new tokens in the sentence to improve the attack strength of bae. these perturbations in the input sentence are achieved by masking a part of the input and using a lm to fill in the mask (see figure 1 ). our bae attack beats the previous baselines by a large margin on empirical evaluation over multiple datasets and models. we show that, surprisingly, just a few replace/insert operations can reduce the accuracy of even a powerful bert classifier by over 80% on some datasets. moreover, our human evaluation reveals the improved grammaticality of the adversarial examples generated by bae over the baseline textfooler, which can be attributed to the bert-mlm. to the best of our knowledge, we are the first to use a lm for generating adversarial examples. we summarize our contributions as: we are given a dataset (s, y ) = {(s 1 , y 1 ), . . . (s m , y m )} and a trained classification model c : @xmath0. we assume the soft-label black-box setting where the attacker can only query the classifier for output probabilities on a given input, and does not have access to the model parameters, gradients or training data. for an input pair (@xmath1, . . . , t n ], y), we want to generate an adversarial example s adv such that c(s adv ) =y. additionally we would like s adv to be grammatically correct and semantically similar to s. bae. for generating an adversarial example s adv , we introduce 2 types of token-level perturbations: (i) replace a token @xmath2. some tokens in the input contribute more towards the final prediction by c algorithm 1: bae-r pseudocode input: sentence @xmath3, . . . , tn], ground truth label y, classifier model c output: adversarial example s adv initialization: s adv ← s compute token importance ii ∀ @xmath4:i-1] [m ]s adv[i+1:n] predict top-k tokens t for mask @xmath5:i-1] [t]s adv[i+1:n] end if ∃ @xmath6.t c(l[t]) = y then return: s adv ← l[t ] where c(l[t ]) = y, l[t ] has maximum similarity with s else s adv ← l[t ] where l[t ] causes maximum reduction in probability of y in c(l[t ]) end if end return: s adv ← n one the replace (r) and insert (i) operations are performed on a token t by masking it and inserting a mask token adjacent to it respectively. the pretrained bert-mlm is used to predict the mask tokens (see figure 1 ). bert-mlm is a powerful lm trained on a large training corpus (∼ 2 billion words), and hence the predicted mask tokens fit well into the grammar and context of the text. the bert-mlm, however, does not guarantee semantic coherence to the original text as demonstrated by the following simple example. consider the sentence: 'the food was good'. for replacing the token 'good', bert-mlm may predict the token 'bad', which fits well into the grammar and context of the sentence, but changes the original sentiment of the sentence. to achieve a high semantic similarity with the original text on introducing perturbations, we filter the set of top k tokens (k is a pre-defined constant) predicted by bert-mlm for the masked token, using a universal sentence encoder (use) based sentence similarity scorer @xcite . for the r operation, we additionally filter out predicted tokens that do not form the same part of speech (pos) as the original token. if multiple tokens can cause c to misclassify s when they replace the mask, we choose the token which makes s adv most similar to the original s based on the use score. if no token causes misclassification, then we choose the one that decreases the prediction probability p (c(s adv )=y) the most. we apply these token perturbations iteratively in decreasing order of token importance, until either c(s adv ) =y (successful attack) or all the tokens of s have been perturbed (failed attack). we present 4 attack modes for bae based on the r and i operations, where for each token t in s: we use 3 popular text classification models: word-lstm @xcite , word-cnn @xcite and a fine-tuned bert @xcite base-uncased classifier. we train models on the training data and perform the adversarial attack on the test data. for complete model details, refer to appendix a. as a baseline, we consider textfooler @xcite which performs synonym replacement using a fixed word embedding space @xcite . we only consider the top @xmath7.8 for the cosine similarity between use based embeddings of the adversarial and input text. ## conclusion in this paper, we have presented a new technique for generating adversarial examples (bae) through contextual perturbations based on the bert masked language model. we propose inserting and/or replacing tokens from a sentence, in their order of importance for the text classification task, using a bert-mlm. automatic and human evaluation on several datasets demonstrates the strength and effectiveness of our attack.