N at L og A ttack: A Framework for Attacking Natural Language Inference Models with Natural Logic (2023)

Abstract: Reasoning has been a central topic in artificial intelligence from the beginning. The recent progress made on distributed representation and neural networks continues to improve the state-of-the-art performance of natural language inference. However, it remains an open question whether the models perform real reasoning to reach their conclusions or rely on spurious correlations. Adversarial attacks have proven to be an important tool to help evaluate the Achilles’ heel of the victim models. In this study, we explore the fundamental problem of developing attack models based on logic formalism. We propose NatLogAttack to perform systematic attacks centring around natural logic, a classical logic formalism that is traceable back to Aristotle’s syllogism and has been closely developed for natural language inference. The proposed framework renders both label-preserving and label-flipping attacks. We show that compared to the existing attack models, NatLogAttack generates better adversarial examples with fewer visits to the victim models. The victim models are found to be more vulnerable under the label-flipping setting. NatLogAttack provides a tool to probe the existing and future NLI models’ capacity from a key viewpoint and we hope more logic-based attacks will be further explored for understanding the desired property of reasoning.

## introduction while deep neural networks have achieved the stateof-the-art performance on a wide range of tasks, the models are often vulnerable and easily deceived by imposing perturbations to the original input @xcite , which seriously hurts the accountability of the systems. in depth, this pertains to model robustness, capacity, and the development of models with more advanced intelligence. natural language inference (nli), also known as textual entailment @xcite @xcite , is a fundamental problem that models the inferential relationships between a premise and hypothesis sentence. the models built on distributed representation have significantly improved the performance on different benchmarks @xcite @xcite @xcite @xcite . however, it is still highly desirable to conduct research to probe if the models possess the desired reasoning ability rather than rely on spurious correlation to reach their conclusions @xcite @xcite @xcite . adversarial attacks have proven to be an important tool to reveal the achilles' heel of victim models. specifically for natural language inference, the logic relations are easily broken if an attack model does not properly generate the adversarial examples following the logic relations and related semantics. therefore, unlike other textual attack tasks such as those relying on semantic similarity and relatedness, it is more challenging to create effective attacks here. in this study, we explore the basic problem of developing adversarial attacks based on logic formalism, with the aim to probe victim models for the desired reasoning capability. specifically, we propose natlogattack, in which the adversarial attacks are generated based on natural logic @xcite @xcite @xcite @xcite , a classical logic formalism with a long history that has been closely developed with natural language inference. from a general perspective, natural language inference provides an appropriate setup for probing the development of distributed representation and the models based on that. a robust solution for the task requires manipulation of discrete operations and adversarial attacks can help understand whether and how the required symbols and inference steps emerge from the data and the learned distributed representation. our work has also been inspired by recent research on exploring the complementary strengths of neural networks and symbolic models @xcite @xcite @xcite @xcite @xcite . our research contributes to the development of logic-based adversarial attacks for natural language understanding. specifically, we propose a novel attack framework, natlogattack, based on natural logic for natural language inference. our experiments with both human and automatic evaluation show that the proposed model outperforms the state-of-the-art attack methods. compared to the existing attack models, natlogattack generates better adversarial examples with fewer visits to the victim models. in addition to the commonly used attack setting where the labels of generated examples remain the same as the original pairs, we also propose to construct label-flipping attacks. the victim models are found to be more vulnerable in this setup and natlogattack succeeds in deceiving them with much smaller numbers of queries. natlogattack provides a systematic approach to probing the existing and future nli models' capacity from a basic viewpoint that has a traceable history, by combining it with the recent development of attacking models. the proposed framework is constrained by the natural logic formalism and we hope more logic-based attacks will be further explored for understanding the desired property of natural language reasoning. in terms of perturbation granularities, characterlevel attacks modify characters @xcite while word-level models rely on word substitutions that can be performed based on word embeddings @xcite , language models @xcite , or even external knowledge bases @xcite . sentence-level attack models add perturbation to an entire sentence by performing paraphrasing @xcite or attaching distracting sentences @xcite . @xcite generated natural language inference examples based on entailment label composition functions with the help of lexical knowledge. @xcite utilized a set of first-order-logic constraints to measure the degree of rule violation for natural language inference. the efforts utilized the generated examples for data augmentation. the focus is not on adversarial attack and the adversarial examples' quality, e.g., the attack validity, is not evaluated. ## conclusion towards developing logic-based attack models, we introduce a framework natlogattack, which centres around the classical natural logic formalism. the experiments with human and automatic evaluation show that the proposed framework outperforms the existing attack methods. compared to these models, natlogattack generates better adversarial examples with fewer visits to the victim models. in addition to the widely used labelpreserving attacks, natlogattack also provides label-flipping attacks. the victim models are found to be more vulnerable in this setup and natlogattack succeeds in deceiving them with attack model premise hypothesis pwws betty lives in berlin betty lives animation in germany textfooler betty lives in berlin betty lives dies in germany pso --bertattack betty lives in berlin prague betty lives in germany clare betty lives in berlin australia betty lives in germany natlogattack betty lives in berlin betty lives in germany federal republic of germany pwws a snow goose jackass is a water bird a goose is a water bird textfooler a snow goose is a water bird a goose is a water bird parakeets pso a snow goose is a water bird a goose chicken is a water bird bertattack a snow goose the is a water bird a goose is a water bird clare a snow goose cat is a water bird a goose is a water bird natlogattack a snow goose is a water bird a goose is a water bird chordate pwws --textfooler --pso --bertattack i can't speak german at all i can't cantheisland speak german confidently and never at all clare i can't speak german at all i can't speak spoke german confidently at all natlogattack i can't speak german at all i can't speak german confidently at all on trampoline pwws the purple majestic alien did not throw balls the purple alien did not throw tennis balls textfooler the purple alien did not throw balls the purple crimson alien did not throw tennis opening balls pso the purple alien did not throw balls the purple alien unicorn did not throw tennis balls bertattack the purple blue alien did not throw balls the purple alien did not throw tennis balls clare the purple alien did not throw soccer balls the purple alien did not throw balls natlogattack the purple alien did not throw balls the purple alien did not throw tennis balls on her cellphone