V al CAT : Variable-Length Contextualized Adversarial Transformations Using Encoder-Decoder Language Model (2022)

Abstract: Adversarial texts help explore vulnerabilities in language models, improve model robustness, and explain their working mechanisms. However, existing word-level attack methods trap in a one-to-one attack pattern, i.e., only a single word can be modified in one transformation round, and they ignore the interactions between several consecutive words. In this paper, we propose ValCAT, a black-box attack framework that misleads the language model by applying variable-length contextualized transformations to the original text. Compared to word-level methods, ValCAT expands the basic units of perturbation from single words to spans composed of multiple consecutive words, enhancing the perturbation capability. Experiments show that our method outperforms state-of-the-art methods in terms of attack success rate, perplexity, and semantic similarity on several classification tasks and inference tasks. The comprehensive human evaluation demonstrates that ValCAT has a significant advantage in ensuring the fluency of the adversarial examples and achieves better semantic consistency. We release the code at https://github.com/linerxliner/ValCAT .

## introduction deep learning is successfully applied in a variety of fields, while previous works have found that neural network models are vulnerable to well-constructed adversarial examples @xcite . in general, adversarial examples are constructed by adding imperceptible perturbations to the benign inputs, which can mislead the victim model. and exploring adversarial examples is essential to improving the reliability and robustness of neural network models. compared to the long-studied image domain, generating adversarial examples on texts is more difficult because texts are discrete, where small changes can alter the original ag news (business) lucent milestone: a profit lucent technologies yesterday posted higher fiscal fourth-quarter earnings, helping lift the telecommunications equipment maker to its first profitable year since 2000. ## valcat to further improve the attack effectiveness and simultaneously improve the readability and semantic similarity of the adversarial examples, we propose valcat, which can generate high-quality adversarial text by applying variable-length contextualized transformations with the encoder-decoder language model. problem formalization given a victim model f : @xmath0...w n-1 w n that can be correctly classified by f , the attack goal is to generate an adversarial text x, which can confuse the model prediction, i.e. f (x) ̸ = f (x). a consecutive word sequence with length l can be denoted as a span s i:i+l . in the soft-label black-box setting, the attacker only has access to the logit output p (y|x). the architecture, parameters, and configurations of f are unknown to the attacker. to achieve human imperceptibility, the attacker should minimize textual perturbations and maintain semantic consistency. valcat the attack workflow of valcat is illustrated in figure 1 . to locate the most-vulnerable positions for the perturbations in each iteration, val-cat first rank the spans in x according to their importance with sliding windows of length 1 to max, as lines 2-7 in algorithm 1. based on the sorted span ranking r, valcat uses the encoder-decoder language model to generate variable-length contextualized spans, as lines 8-13. using two transformation operations in line 9, replace and insert, we obtain a adversarial text candidate set t . if some of the candidates can mislead the victim model, valcat declares the one with the highest cosine similarity with the original text as the final successful result, as line 11. however, if no candidate successes at this iteration, we select the one with the highest negative impact to the victim model as the basic text for the next iteration, as line 13. note that, if a span in the ranking r has been selected as the target span, the subsequent spans which are overlapped with it will be removed from the ranking to avoid multiple modifications on one word. the attack ends when the successful example appears, or when the limit of the perturbation constraints (see section 3.1) reached. the latter case is considered a final failure. below we elaborate on the two stages of the attack in section 2.1 and section 2.2 in detail. ## experiments in this section, we evaluate valcat on two nlp tasks, text classification and natural language inference. to demonstrate the effectiveness of valcat in terms of fluency, grammaticality, and semantic consistency, following li et al. 2021, we design and conduct a comprehensive human evaluation. ## related work textual adversarial attacks have been intensively studied @xcite . early on, the character-level attack methods @xcite @xcite are widely used, but they would destroy words and are very perceptible @xcite . word-level attack methods are now in the spotlight, evolving from substitution based only on the properties of individual words themselves @xcite @xcite to perturbing words by multiple strategies with knowledge of the context @xcite @xcite . although these existing works may enrich the transformation form with various operations like insertion, deletion, merging, etc., they still treat single words as basic units of each transformation. some sentence-level works @xcite @xcite generate adversarial examples by perturbing the latent representation of the original text, but they are slightly worse at controlling the text quality. our work introduces the sliding window to rank important spans and generates variable-length contextualized spans by the encoder-decoder language model, enabling more effective adversarial attacks and higher-quality adversarial examples. ## conclusion in this paper, we propose valcat, the first variablelength contextualized adversarial attack based on the encoder-decoder language model. valcat considers the interaction between words for the vulnerable-position discovery and expands the basic units of perturbation from single words to spans. experimental results on several datasets demonstrate the effectiveness of our methods, which outperforms baselines in terms of attack success rate, perplexity, and semantic similarity. our adversarial examples also have good transferability and help to improve robustness. a comprehensive human evaluation further verifies the high quality of the adversarial examples generated by valcat.