Multi-granularity Textual Adversarial Attack with Behavior Cloning (2021)

Abstract: Recently, the textual adversarial attack models become increasingly popular due to their successful in estimating the robustness of NLP models. However, existing works have obvious deficiencies. (1)They usually consider only a single granularity of modification strategies (e.g. word-level or sentence-level), which is insufficient to explore the holistic textual space for generation; (2) They need to query victim models hundreds of times to make a successful attack, which is highly inefficient in practice. To address such problems, in this paper we propose MAYA, a Multi-grAnularitY Attack model to effectively generate high-quality adversarial samples with fewer queries to victim models. Furthermore, we propose a reinforcement-learning based method to train a multi-granularity attack agent through behavior cloning with the expert knowledge from our MAYA algorithm to further reduce the query times. Additionally, we also adapt the agent to attack black-box models that only output labels without confidence scores. We conduct comprehensive experiments to evaluate our attack models by attacking BiLSTM, BERT and RoBERTa in two different black-box attack settings and three benchmark datasets. Experimental results show that our models achieve overall better attacking performance and produce more fluent and grammatical adversarial samples compared to baseline models. Besides, our adversarial attack agent significantly reduces the query times in both attack settings. Our codes are released at https://github.com/Yangyi-Chen/MAYA .

## introduction deep learning has been proven to be successful for many real-world applications such as spam filtering @xcite , autonomous driving @xcite , and face recognition @xcite . however, these powerful models are vulnerable to adversarial samples, crafted by adding small, human-imperceptible perturbations to the input @xcite . in the domain of computer vision, numerous adversarial attack models have been proposed to benchmark and interpret black-box deep learning models @xcite @xcite and corresponding defense methods have also been proposed to tackle adversarial security issues @xcite @xcite . however, crafting textual adversarial samples is more challenging due to the discrete and nondifferentiable nature of text space. indeed, most existing works focus on a single granularity of modification strategies, such as sentence-level @xcite , word-level @xcite or characterlevel @xcite . thus, none of such attack models find the optimal solution through multi-granularities for launching attacks simultaneously, which is more efficient to generate high-performance and effective adversarial samples while preserving semantic consistency and language fluency. to this end, we propose a simple and novel attack model targeting on multiple kinds of granularity called maya, which achieves higher attack success rate with fewer queries to victim models and produces high-quality adversarial samples compared to baseline attack models. specifically, we add perturbations to the original sentence via rewriting its constituents according to the strict grammatical constraints. besides, almost all current attack models need to query victim models hundreds or even thousands of times to launch a successful attack 1 and assume the victim models may output the confidence scores of their predictions, which is neither efficient nor practical in real-world situations. to alleviate such problems, we propose to train a multigranularity attack agent called maya π through behavior cloning @xcite with the expert knowledge from our maya algorithm. we conduct exhaustive experiments including attacking three victim models over three benchmark datasets in two different black-box settings, namely score-based and decision-based attack, to evaluate the effectiveness of our attack models. while the former supposes the labels and the confidence scores of the victim models are available, the latter assumes only the label information can be accessed while the other is unknown, which is more challenging and rarely investigated. experimental results demonstrate the superiority of our attack models. specifically, maya overall outperforms all baseline models in terms of attack success rate, attack efficiency, and quality of adversarial samples. maya π achieves comparable attack success rate and adversarial samples quality with baseline models while significantly reduces the query times in two black-box settings. furthermore, we apply maya π to attack open-source nlp frameworks to demonstrate its practicality and effectiveness in practice. to summarize, the main contributions of this paper are as follows: ## related work existing textual adversarial attack models can be roughly categorized according to the granularity of modification, e.g., character-level, word-level, sentence-level. sentence-level attack models often contain paraphrasing original sentences following pre-defined syntax patterns @xcite , adding an irrelevant sentence to the end of the passage to distract models @xcite , and conducting domain shift on original sentences @xcite . however, sentence-level attacks usually neglect fine-grained granularity, such as word-level, resulting in low attack success rate. word-level attack is relatively more investigated and can be modeled as a combinatorial optimization problem @xcite , including finding substitution words and searching for adversarial samples. the methods of finding candidate substitutes mainly focus on the similarity of word embeddings @xcite , wordnet synonyms @xcite , hownet synonyms @xcite , and masked language model (mlm) @xcite . generally, the search algorithms involve greedy search algorithm @xcite @xcite , genetic algorithm @xcite , and particle swarm optimization @xcite . although these attack models can achieve relatively high attacking performance, considering only a single granularity restricts the upper bound of word-level attack models' performance and almost all these models need to query victim models hundreds of times to launch a successful attack. character-level attacks make different modifications to words such as swapping, deleting, and inserting characters @xcite @xcite . these attack models often craft ungrammatical adversarial samples and can be easily defended @xcite . hence, in this work, we do not incorporate character-level modification into our multi-granularity framework. to sum up, all above models only consider a single granularity and thus are insufficient in exploring the textual space for generation. so, we propose to launch attacks on multiple granularities in this paper. experimental results demonstrate the effectiveness and efficiency of our method. ## methodology in this section, we first describe our multigranularity attack (maya) model in detail. then we introduce how to train an attack agent, denoted as maya π , with the knowledge from our maya algorithm. finally, we describe how we adapt maya π to perform decision-based black-box attack. ## experiments we conduct comprehensive experiments to evaluate our attack models on the tasks of sentiment analysis, natural language inference, and news classification. ## conclusion and future work in this paper, we propose a multi-granularity adversarial attack model (maya) and propose a rlbased method to train an attack agent (maya π ) through behavior cloning with the expert knowledge from our maya algorithm. further, we adapt maya π to decision-based attack setting, handling the issues of attacking models that only output decisions. experimental results show that our attack models achieve overall higher attacking performance and produce more fluent and grammatical adversarial samples. we also show that maya π can launch adversarial attacks towards open-source nlp frameworks, demonstrating the practicability of our attack agent in real-world situations. in the future, we will focus on how to improve current models' robustness towards multigranularity attacks. in addition, we will try to apply maya π to other less investigated settings in textual adversarial attack, such as to launch target attacks in decision-based attack setting.