A rabic Synonym BERT -based Adversarial Examples for Text Classification (2024)

Abstract: Text classification systems have been proven vulnerable to adversarial text examples, modified versions of the original text examples that are often unnoticed by human eyes, yet can force text classification models to alter their classification. Often, research works quantifying the impact of adversarial text attacks have been applied only to models trained in English. In this paper, we introduce the first word-level study of adversarial attacks in Arabic. Specifically, we use a synonym (word-level) attack using a Masked Language Modeling (MLM) task with a BERT model in a black-box setting to assess the robustness of the state-of-the-art text classification models to adversarial attacks in Arabic. To evaluate the grammatical and semantic similarities of the newly produced adversarial examples using our synonym BERT-based attack, we invite four human evaluators to assess and compare the produced adversarial examples with their original examples. We also study the transferability of these newly produced Arabic adversarial examples to various models and investigate the effectiveness of defense mechanisms against these adversarial examples on the BERT models. We find that fine-tuned BERT models were more susceptible to our synonym attacks than the other Deep Neural Networks (DNN) models like WordCNN and WordLSTM we trained. We also find that fine-tuned BERT models were more susceptible to transferred attacks. We, lastly, find that fine-tuned BERT models successfully regain at least 2% in accuracy after applying adversarial training as an initial defense mechanism.

## introduction machine learning models, in general, are vulnerable to adversarial attacks, which are small, crafted perturbations done usually by altering the original input of these models in order to change their classification @xcite @xcite @xcite @xcite . once a predicated token satisfies the grammar and semantic checkings, we have an attack candidate example. research on adversarial attacks is often in the domain of image classification systems @xcite @xcite @xcite or speech recognition systems @xcite @xcite @xcite . for example, in the domain of image classification, the images are the original inputs, and the attackers could negatively affect the performance of these systems by introducing small perturbations to the input images @xcite @xcite . examining adversarial attacks in the domain of natural language processing (nlp) can be especially challenging due to the discrete nature of the input texts and the requirement to preserve both semantic coherence and grammatical correctness with the original texts @xcite @xcite . or training datasets @xcite , whereas in the gray-box approach, the attackers have limited access to the model architecture @xcite . finally, in the black-box approach, the attackers cannot access the model architecture but only query the model and get a prediction in return @xcite . a few common techniques for producing adversarial text examples have been addressed widely in the nlp field, such as character-level attacks (like inserting, removing, or swapping one or more characters within a word), word-level attacks (like inserting, removing, or replacing a word), and sentence-level attacks (like inserting, removing, or replacing a word or more than a word in a sentence) @xcite @xcite @xcite . some of these techniques can result in unnatural adversarial examples, making them easily distinguishable by humans, but recent research indicates that using rule-based synonym replacement strategies could generate adversarial text examples that appear more natural and similar to the original examples @xcite @xcite @xcite . only two papers addressed adversarial text attacks in arabic, and both are character-level. alshemali and kalita (2019) proposed character-level adversarial attacks that rely on changing the morphological form of adjectives by adding one or more characters, which violates the noun-adjective agreement. an adjective is a word that describes a noun, and it must agree with the noun in definiteness (i.e., definite or indefinite), number (singular or dual), and gender (i.e., feminine or masculine). @xcite also proposed character-level attacks, which relied on the flip of one or two arabic characters chosen based on non-native arabic learners' most common spelling mistakes (usually incorrect use of visually similar characters). both of these studies considered only the character-level adversarial examples and did not investigate the impact of transferability of these attacks among targeted models nor the effectiveness of defense mechanisms like adversarial training. in this paper, we introduce the first study of word-level adversarial attacks in arabic. we develop synonym-based word-level attacks using a masked language modeling (mlm) task with an arabic bert model in a black-box manner against three state-of-the-art sentiment analysis classifiers/models: bert (bidirectional encoder representations from transformers) @xcite , wordcnn (word-based convolutional neural networks) @xcite , and wordlstm (wordbased long short-term memory) @xcite . we train these models on two available and large arabic datasets, hard (hotel arabic reviews dataset) @xcite and msda (sentiment analysis for social media posts in arabic dialect) @xcite , to automatically generate adversarial text examples, attack these models using those generated adversarial text examples, and finally, assess the robustness of these models against adversarial text examples. we also use human evaluation to evaluate the newly produced adversarial text examples using two criteria: grammatical similarity and semantic similarity. furthermore, we study the transferability of these adversarial text examples generated by various models on different models studied and deeply investigate the effectiveness of the adversarial training defense mechanism on the bert models against these adversarial text examples. figure 1 illustrates the process of generating synonymbased word-level adversarial examples generation which we discuss in detail in section 3. section 2 reviews related research works, while section 3 delves into the methodology in more detail. sections 4 and 5 discuss the automatic and human evaluations and their results. in sections 6 and 7, we describe the transferability and defense mechanisms, along with their results. lastly, in sections 8 and 9, we conclude our paper by addressing its limitations and summarizing our contributions. ## related work adversarial text attacks have been widely studied in the nlp field from different perspectives, like the attack setting (white-box, gray-box, and black-box), targeted space (embedding or input), and attack method (character-level, word-level, sentence-level) @xcite @xcite @xcite @xcite @xcite @xcite @xcite . here, we will focus on related work that shares the same methodology as ours, taking advantage of the pre-trained models like the bert model and its mlm training objective, but notably, they are all done only in english. @xcite integrated two synonym replacement strategies @xcite and proposed a baseline method called textfooler to efficiently generate adversarial examples using synonym replacement techniques through word embeddings, ensuring the preservation of similar semantic meaning compared to the original words. their findings show that pretrained bert models and other deep neural networks (dnn) models were vulnerable to these adversarial text attacks, which could lead to misclassification or incorrect textual entailment predictions. the authors also emphasized improving the robustness of nlp models by incorporating defense mechanisms and testing their performance against adversarial attacks. several studies have proposed novel synonym replacement techniques using the mlm task with large language models (llms) like bert. for instance, @xcite proposed a novel method called bert-based adversarial examples (bae) for generating adversarial examples for text classification using mlm with bert models. by utilizing pre-trained bert's ability to capture semantic meaning and context in text, bae could generate adversarial examples more effectively than previous methods, avoiding detection by state-of-the-art classifiers. the authors also evaluated the effectiveness of bae against various text classification models and demonstrated that it could generate robust adversarial examples. li et al. (2020) proposed a practical method called bert-attack using mlm with bert models to predict sub-word expansion, ensuring the generation of fluent and semantically preserved adversarial text examples. these adversarial examples successfully fooled the state-of-the-art models, such as the fine-tuned bert models for various downstream tasks in nlp in a black-box manner. the authors evaluated the bert-attack's effectiveness against bert models in various text classification tasks and demonstrated its ability to reduce the accuracy of these models significantly. lastly, @xcite proposed an attack method called clare, a contextualized adversarial example generation model that could generate fluent and grammatically accurate outputs through a fill-in-mask procedure using mlm with roberta models. clear introduced three contextualized perturbations: replace, insert, and merge, which permit generating outputs of varying lengths, where it could flexibly integrate these perturbations and apply them at any position in the inputs and then use them to attack the bert models. the authors finally evaluated clare's effectiveness against bert models and demonstrated that clare achieved the best performance with the least modifications by combining all these three perturbations. ## transferability 6.1 setup of transferability the transferability of an adversarial attack refers to its ability to reduce the accuracy of the targeted models (victim models) to a certain extent when attacked by the newly generated adversarial examples from other models (source models), where all the victim and source models trained on the same dataset @xcite . to closely examine the transferability, we examine 245 adversarial examples from each of the hard and msda datasets along with their corresponding original examples. initially, we predict the accuracy of both the original examples and their corresponding adversarial examples using the victim models. we then calculate the difference (delta ∆) between the prediction accuracy of the original examples and the adversarial examples, ultimately determining the transferability score for each model. we have not seen any other researcher using this delta difference method for the transferability of adversarial text attacks, even in english. ## limitations due to the lack of availability of strong foundation models in arabic and our lack of computational resources, one limitation of our attack is that it fundamentally depends on the pre-trained arabic and multilingual models like the arabert model for retrieving synonym words, the camelbert model for grammatical similarity checking, and the sentence-transformers model for semantic similarity checking, where their performance creates a bottleneck for the effectiveness of our text adversarial attack and the quality of our produced adversarial examples. another limitation of our work is that the successfulness of our attack in generating adversarial examples is higher than its impact on the targeted models because the evaluation misclassification rate of the targeted models is another bottleneck of our attack, meaning if a model's original (evaluation) accuracy score is 86% (e.g., bert model on the msda dataset), then the misclassification rate of the model is 14%, which undoubtedly affects the effectiveness of our attack negatively, especially since our attack setting is black-box, where it is impossible to remove these misclassified examples without compromising the attack setting (if we remove these misclassified examples, the attack setting will be a white-box). ## conclusion in this work, we introduce the first arabic synonym bert-based adversarial attack using an mlm task with pre-trained bert models against the stateof-the-art text classification models. we utilize two large arabic datasets, namely hard and msda, in a black-box manner. we find that bert and other dnn models are generally susceptible to these arabic adversarial examples, especially bert models. we ask human evaluators to evaluate our produced adversarial examples using our attack in terms of grammatical similarity and semantic similarity and find that our attack generates examples that preserve semantic similarity and maintain arabic grammar. we also study the transferability of these arabic adversarial text examples by various source models on different victim models and observe that fine-tuned bert models exhibit higher transferability when attacked by the other dnn models' generated adversarial examples. lastly, we investigate the effectiveness of the adversarial training defense mechanism on bert models and find that the bert models successfully regain at least 2% of their accuracies after applying the adversarial training as a defense mechanism.