CT - GAT : Cross-Task Generative Adversarial Attack based on Transferability (2023)

Abstract: Neural network models are vulnerable to adversarial examples, and adversarial transferability further increases the risk of adversarial attacks. Current methods based on transferability often rely on substitute models, which can be impractical and costly in real-world scenarios due to the unavailability of training data and the victim model’s structural details. In this paper, we propose a novel approach that directly constructs adversarial examples by extracting transferable features across various tasks. Our key insight is that adversarial transferability can extend across different tasks. Specifically, we train a sequence-to-sequence generative model named CT-GAT (Cross-Task Generative Adversarial Attack) using adversarial sample data collected from multiple tasks to acquire universal adversarial features and generate adversarial examples for different tasks.We conduct experiments on ten distinct datasets, and the results demonstrate that our method achieves superior attack performance with small cost.

## introduction neural network-based natural language processing (nlp) is increasingly being applied in real-world tasks @xcite @xcite . however, neural network models are vulnerable to adversarial examples @xcite @xcite . attackers can bypass model-based system monitoring by intentionally constructing adversarial samples to fulfill their malicious objectives, such as propagating rumors or hate speech. even worse, researchers have discovered the phenomenon of adversarial transferability, where adversarial examples can propagate across models trained on the same or similar tasks @xcite @xcite @xcite et @xcite . this transferability enables attackers to target victim models using adversarial examples crafted by substitute models. the majority of existing research on adversarial transferability involves training one or more substitute models that perform identical or similar tasks to the victim model @xcite . however, due to the constraints of the black box scenario, the attacker lacks access to the training data and structural details of the victim model, making it exceedingly challenging to train comparable substitute models. consequently, it becomes arduous to achieve a satisfactory success rate in adversarial attacks solely through transferability between models based on the same task. to mitigate the above challenges, we introduce a method that directly constructs adversarial examples by extracting transferable features across various tasks, without the need for constructing task-specific substitute models. our key insight is that adversarial transferability is not limited to models trained on the same or similar tasks, but rather extends to models across different tasks. there are some observations that support our idea. for instance, we discovered that adversarial word substitution rules offer a variety of highly transferable candidate replacement words. as illustrated in figure 1 , a larger pool of candidate words can be utilized to generate a diverse set of highly transferable adversarial samples, thereby compensating for the shortcomings of previous methods that relied on greedy search. in particular, we train a sequence-tosequence generative model ct-gat (cross-task gerative adversarial attack) using adversarial sample data obtained from multiple tasks. remarkably, we find that the generated adversarial sample can effectively attack test tasks, even in the absence of specific victim model information. we conduct attack experiments on five securityrelated nlp tasks across ten datasets, adhering to the advbench @xcite paradigm of security-oriented natural language processing (soadnlp), a framework that mirrors real-world application scenarios more closely. and the experiments demonstrate that our method achieves the best attack performance while using a relatively small number of queries. to summarize our contributions to this paper are as follows: ## related work in this section, we review the recent works on adversarial attacks, with a focus on transferability-based approaches. white-box attacks are prominent methods in attack methods, which can obtain high attack success rate and low distortion adversarial data with few access times. typical white-box attack methods included cwba @xcite , gbda @xcite . the effectiveness of obtaining adversarial samples efficiently in these scenarios stemmed from the fact that attackers have comprehensive access to information, including the model's structure, parameters, gradients, and training data. black-box attacks assume that the attacker only has knowledge of the confidence or decision of the target's output, including query-based attacks and transfer-based attacks. query-based attack methods include pwws @xcite , textbugger @xcite , hotflip @xcite , etc. these methods often required hundreds of queries to successfully obtain low-distortion adversarial samples, and the attack effect may have been worse in the decision-based scenario. adversarial transferability has been observed across different models @xcite . this poses a threat to the security of decision-based black-box models. attackers employ white-box attacks to obtain adversarial samples on substitute models. this method is prone to overfitting, resulting in limited transferability. to address this issue, some methods proposed using mid-layer features instead of the entire model to obtain more generalized adversarial samples @xcite . however, this approach has not been widely applied in the text adversarial domain. model aggregation methods were primarily used in the text domain, although the overall research in this area was not extensive. additionally, there were approaches that extracted adversarial perturbation rules as a basis for adversarial features @xcite . this rule-based approach provided insights into leveraging the distinctive characteristics of different adversarial samples. ## experiments and results in this chapter, we evaluate the performance of ct-gat in the decision-based black-box scenario, using the security-oriented nlp benchmark advbench. to demonstrate the high interpretability of ct-gat in practical settings, we also conducted a manual evaluation. ## further analysis in this chapter, our objective is to thoughtfully examine the areas where prior research could possibly be further enriched, particularly in terms of transferability. simultaneously, we will elucidate the factors that enable our approach to effectively harness certain transferable attributes. ## conclusion in this article, we propose a cross-task generative adversarial attack (ct-gat), which is based on our insight that adversarial transferability exists across different tasks. our method solves the problem of needing to train a substitute model for the victim model. experiment demonstrates that our method not only significantly increases the attack success rate, but also drastically reduces the number of required queries, thus underscoring its practical utility in real-world applications.