BERT - ATTACK : Adversarial Attack Against BERT Using BERT (2020)

Abstract: Adversarial attacks for discrete data (such as texts) have been proved significantly more challenging than continuous data (such as images) since it is difficult to generate adversarial samples with gradient-based methods. Current successful attack methods for texts usually adopt heuristic replacement strategies on the character or word level, which remains challenging to find the optimal solution in the massive space of possible combinations of replacements while preserving semantic consistency and language fluency. In this paper, we propose BERT-Attack , a high-quality and effective method to generate adversarial samples using pre-trained masked language models exemplified by BERT. We turn BERT against its fine-tuned models and other deep neural models in downstream tasks so that we can successfully mislead the target models to predict incorrectly. Our method outperforms state-of-the-art attack strategies in both success rate and perturb percentage, while the generated adversarial samples are fluent and semantically preserved. Also, the cost of calculation is low, thus possible for large-scale generations. The code is available at https://github.com/LinyangLee/BERT-Attack .

## introduction despite the success of deep learning, recent works have found that these neural networks are vulnerable to adversarial samples, which are crafted with small perturbations to the original inputs @xcite @xcite . that is, these adversarial samples are imperceptible to human judges while they can mislead the neural networks to incorrect predictions. therefore, it is essential to explore these adversarial attack methods since the ultimate goal is to make sure the neural networks are highly reliable * corresponding author. and robust. while in computer vision fields, both attack strategies and their defense countermeasures are well-explored @xcite , the adversarial attack for text is still challenging due to the discrete nature of languages. generating of adversarial samples for texts needs to possess such qualities: (1) imperceptible to human judges yet misleading to neural models; (2) fluent in grammar and semantically consistent with original inputs. previous methods craft adversarial samples mainly based on specific rules @xcite @xcite @xcite @xcite . therefore, these methods are difficult to guarantee the fluency and semantically preservation in the generated adversarial samples at the same time. plus, these manual craft methods are rather complicated. they use multiple linguistic constraints like ner tagging or pos tagging. introducing contextualized language models to serve as an automatic perturbation generator could make these rules designing much easier. the recent rise of pre-trained language models, such as bert @xcite , push the performances of nlp tasks to a new level. on the one hand, the powerful ability of a fine-tuned bert on downstream tasks makes it more challenging to be adversarial attacked @xcite . on the other hand, bert is a pre-trained masked language model on extremely large-scale unsupervised data and has learned general-purpose language knowledge. therefore, bert has the potential to generate more fluent and semantic-consistent substitutions for an input text. naturally, both the properties of bert motivate us to explore the possibility of attacking a fine-tuned bert with another bert as the attacker. in this paper, we propose an effective and high-quality adversarial sample generation method: bert-attack, using bert as a language model to generate adversarial samples. the core algorithm of bert-attack is straightforward and consists of two stages: finding the vulnerable words in one given input sequence for the target model; then applying bert in a semantic-preserving way to generate substitutes for the vulnerable words. with the ability of bert, the perturbations are generated considering the context around. therefore, the perturbations are fluent and reasonable. we use the masked language model as a perturbation generator and find perturbations that maximize the risk of making wrong predictions @xcite . differently from previous attacking strategies that require traditional single-direction language models as a constraint, we only need to inference the language model once as a perturbation generator rather than repeatedly using language models to score the generated adversarial samples in a trial and error process. experimental results show that the proposed bert-attack method successfully fooled its finetuned downstream model with the highest attack success rate compared with previous methods. meanwhile, the perturb percentage and the query number are considerably lower, while the semantic preservation is high. to summarize our main contributions: ## related work to explore the robustness of neural networks, adversarial attacks have been extensively studied for continuous data (such as images) @xcite @xcite . the key idea is to find a minimal perturbation that maximizes the risk of making wrong predictions. this minimax problem can be easily achieved by applying gradient descent over the continuous space of images @xcite . however, adversarial attack for discrete data such as text remains challenging. ## bert-attack motivated by the interesting idea of turning bert against bert, we propose bert-attack, using the original bert model to craft adversarial samples to fool the fine-tuned bert model. our method consists of two steps: (1) finding the vulnerable words for the target model and then (2) replacing them with the semantically similar and grammatically correct words until a successful attack. the most-vulnerable words are the keywords that help the target model make judgments. perturbations over these words can be most beneficial in crafting adversarial samples. after finding which words that we are aimed to replace, we use masked language models to generate perturbations based on the top-k predictions from the masked language model. ## conclusion in this work, we propose a high-quality and effective method bert-attack to generate adversarial samples using bert masked language model. experiment results show that the proposed method achieves a high success rate while maintaining a minimum perturbation. nevertheless, candidates generated from the masked language model can sometimes be antonyms or irrelevant to the original words, causing a semantic loss. thus, enhancing language models to generate more semantically related perturbations can be one possible solution to perfect bert-attack in the future.