Pay Attention to the Robustness of C hinese Minority Language Models! Syllable-level Textual Adversarial Attack on T ibetan Script (2023)

Abstract: The textual adversarial attack refers to an attack method in which the attacker adds imperceptible perturbations to the original texts by elaborate design so that the NLP (natural language processing) model produces false judgments. This method is also used to evaluate the robustness of NLP models. Currently, most of the research in this field focuses on English, and there is also a certain amount of research on Chinese. However, to the best of our knowledge, there is little research targeting Chinese minority languages. Textual adversarial attacks are a new challenge for the information processing of Chinese minority languages. In response to this situation, we propose a Tibetan syllable-level black-box textual adversarial attack called TSAttacker based on syllable cosine distance and scoring mechanism. And then, we conduct TSAttacker on six models generated by fine-tuning two PLMs (pre-trained language models) for three downstream tasks. The experiment results show that TSAttacker is effective and generates high-quality adversarial samples. In addition, the robustness of the involved models still has much room for improvement.

## introduction with the development of neural network models, methods based on the models have been widely used in many fields and achieved remarkable performance, such as computer vision, speech recognition, and natural language processing. however, neural network models are susceptible to adversarial attacks @xcite . when textual adversarial attacks are performed on the nlp models for classification tasks, the models with high robustness will make predictions consistent with the original texts after perturbation, while the models with low robustness will make incorrect predictions. section 2 will detail the current research status of textual adversarial attacks on * corresponding author. english and chinese. the information processing technology of chinese minority languages started late, but in recent years, the emergence of chinese minority plms has promoted development but brought new challenges, one of which is textual adversarial attacks. however, there is little research on this topic. the main contributions of this paper are as follows: ## conclusion in this work, we propose a tibetan syllable-level black-box textual adversarial attack called tsattacker. in tsattacker, the syllable cosine distance is used to obtain syllables for substitution, and the scoring mechanism is used to determine the order of syllable substitutions. we conduct tsattacker on six models generated by fine-tuning two versions of the plm cino for three downstream tasks. the experiment results show that tsattacker greatly reduces the model accuracy and has a high attack success rate. also, the adversarial samples generated by tsattacker are high-quality. from a certain point of view, the robustness of the models still has much room for improvement.