Crafting Adversarial Examples for Neural Machine Translation (2021)

Abstract: Effective adversary generation for neural machine translation (NMT) is a crucial prerequisite for building robust machine translation systems. In this work, we investigate veritable evaluations of NMT adversarial attacks, and propose a novel method to craft NMT adversarial examples. We first show the current NMT adversarial attacks may be improperly estimated by the commonly used mono-directional translation, and we propose to leverage the round-trip translation technique to build valid metrics for evaluating NMT adversarial attacks. Our intuition is that an effective NMT adversarial example, which imposes minor shifting on the source and degrades the translation dramatically, would naturally lead to a semantic-destroyed round-trip translation result. We then propose a promising black-box attack method called Word Saliency speedup Local Search (WSLS) that could effectively attack the mainstream NMT architectures. Comprehensive experiments demonstrate that the proposed metrics could accurately evaluate the attack effectiveness, and the proposed WSLS could significantly break the state-of-art NMT models with small perturbation. Besides, WSLS exhibits strong transferability on attacking Baidu and Bing online translators.

## introduction recent studies have revealed that neural machine translation (nmt), which has achieved remarkable progress in advancing the quality of machine translation, is fragile when attacked by some crafted perturbations @xcite @xcite . even if the perturbations on inputs are small and imperceptible to humans, the translation quality could be degraded ## nmt adversary generation let x denote the source language space consisting of all possible source sentences and y denote the target language space. given two nmt models, the primal source-to-target nmt model m @xmath0: @xmath1, while the dual target-to-source nmt model m @xmath2: @xmath3. after the training, nmt can correctly reconstruct the source sentence @xmath4. in the following, we first give the definition of nmt adversarial examples, then introduce our word substitution based blackbox adversarial attack method. ## related work in recent years, adversarial examples have attracted increasing attention in the area of natural language processing (nlp), mainly on text classification @xcite @xcite . for neural machine translation (nmt), there are also some adversary works emerging quickly @xcite @xcite @xcite . on the character level, a few adversarial attacks by manipulating character perturbations have been proposed since 2018. @xcite confront nmt models with synthetic and natural misspelling noises, and show that character-based nmt models are easy to be attacked by character level perturbation. @xcite propose to attack the character level nmt models by manipulating the character-level insertion, swap and deletion. similarly, @xcite perform a gradient-based attack that processes words in source sentences to maximize the translation loss. to attack against production mt systems, @xcite imitate the popular online translators and manipulate the perturbations based on the gradient of the adversarial loss with the imitation models. the above four works also incorporate adversarial training to improve the robustness of nmt. however, the character level perturbations are hard to be applied into confronting practical nmt models, as these perturbations significantly reduce ## conclusion we introduce an appropriate definition of adversarial examples as well as the deriving evaluation measures for the adversarial attacks on neural machine translation (nmt) models. following our definition and metrics, we propose a promising blackbox nmt attack method called the word saliency speedup local search (wsls), in which a general definition of word saliency by leveraging the strong representation capability of pre-trained language models is also introduced. experiments demonstrate that the proposed method could achieve powerful attack performance, that effectively breaks the mainstream rnn and transformer based nmt models. further, our method could craft adversaries with strong readability as well as high transferability to the popular online translators. models (mlm) @xcite , have achieved a powerful initialization for the nmt encoder models. mlm pre-trains the encoder for a better language understanding on the encoded language by randomly masking some tokens in continuous monolingual text streams and predicting these tokens. to predict the masked tokens, the language model pays attention to the relative language parts, which encourages the model to have a better understanding on the language. inspired by the powerful language understanding ability of the pre-trained language models, and following the black-box setting, we use the pre-trained mlm to estimate the word saliency and build the word embedding space for adversarial attacks.