R & R : Metric-guided Adversarial Sentence Generation (2022)

Abstract: Adversarial examples are helpful for analyzing and improving the robustness of text classifiers. Generating high-quality adversarial examples is a challenging task as it requires generating fluent adversarial sentences that are semantically similar to the original sentences and preserve the original labels, while causing the classifier to misclassify them. Existing methods prioritize misclassification by maximizing each perturbation’s effectiveness at misleading a text classifier; thus, the generated adversarial examples fall short in terms of fluency and similarity. In this paper, we propose a rewrite and rollback (R&R) framework for adversarial attack. It improves the quality of adversarial examples by optimizing a critique score which combines the fluency, similarity, and misclassification metrics. R&R generates high-quality adversarial examples by allowing exploration of perturbations that do not have immediate impact on the misclassification metric but can improve fluency and similarity metrics. We evaluate our method on 5 representative datasets and 3 classifier architectures. Our method outperforms current state-of-the-art in attack success rate by +16.2%, +12.8%, and +14.0% on the classifiers respectively. Code is available at https://github.com/DAI-Lab/fibber

## introduction recently, adversarial attacks in text classification have received a great deal of attention. adversarial attacks are defined as subtle perturbations in the input text such that a classifier misclassifies it. they can serve as a tool to analyze and improve the robustness of text classifiers, thus being more and more important because security-critical classifiers are being widely deployed @xcite @xcite . existing attack methods either adopt a synonym substitution approach @xcite ., looks something there is ↓ (keep) ↓ ↑ (discard) ↑ goes stuff is some rollback adversarial sentence: everywhere the camera goes there is stuff worth seeing 2020) or use a pre-trained language model to propose substitutions for better fluency and naturalness @xcite @xcite . they follow a similar framework: first, construct some candidate perturbations, and then, use the perturbations that most effectively mislead the classifier to modify the sentence. this process is repeated multiple times until an adversarial example is found. this framework prioritizes misclassification by picking perturbations that most effectively mislead the classifier. despite the success in changing the classifier prediction, it has two main disadvantages. first, it is prone to modify words that are critical to the sentence's meaning which decreases the similarity and is more likely to change the true label of the sentence, or introduce low-frequency words causing the fluency to decrease. second, some perturbations do not have immediate impacts on misclassification, but can trigger it when combined with other perturbations, and these frameworks cannot find adversarial examples with these perturbations. to overcome these problems, the attack method needs to consider fluency, similarity, and misclassification jointly, while also efficiently exploring various perturbations that do not show direct impacts on the latter. we define a critique score that combines fluency, similarity and misclassification metrics. then, we present our design for a rewrite and rollback framework (r&r) which optimizes this score to generate better adversarial examples. in the rewrite stage, we explore multiword substitutions proposed by a pre-trained language model. we accept or reject a substitution according to the critique score. we can generate a high-quality adversarial example after multiple iterations of rewrite. rewrite may introduce changes that do not contribute to misclassification and may also reduce similarity and fluency. therefore, we periodically apply the rollback operation to reduce the number of modifications without changing the misclassification result. figure 1 illustrates the process using an example. ## problem formulation let @xmath0, . . . , x l be a sentence of length l, y be its classification label, and f (x) be a text classifier that predicts a probability distribution over classes. the objective of an attack method a(x, y, f ) is to human considers u as a fluent sentence, human considers u to be semantically similar to x. human considers u preserves the true label y. we use a fine-tuned bert-base model @xcite to measure perplexity and use unversal sentence encoder (use) @xcite to measure sentence similarity. ultimately, fluency, similarity, and the preservation of original label need to be verified by humans. we discuss human verification in section 4. ## metric-guided rewrite and rollback in this section, we first give an overview, then introduce the rewrite and rollback components respectively. finally, we give a summary of pre-trained models used in the framework. ## experiments we conducted experiments on a wide range of datasets and multiple victim classifiers to show the efficacy of r&r. we first evaluate the quality of adversarial examples using automatic metrics. then, we conducted human evaluation to show the necessity to generate highly similar and fluent adversarial examples. finally, we conduct an ablation study to analyze each component of our method, and discuss defense against the attack. datasets. we use 3 conventional text classification datasets: topic classification, sentiment classification, and question type classification. we also use 2 security-critical datasets: hate speech detection and fake news detection. dataset details are given in baselines. we compare our method against two strong baseline attack methods: textfooler @xcite and clare @xcite . hyperparameters. in r&r, we use the bertbase language model for p lm . for each dataset, we fine-tune the bert language model using 5k batches on the training set foot_1 with batch size 32 and learning rate 0.0001, so it is adapted to the dataset. we set the enforcing distribution hyperparameters w @xmath1. the decision function hyper-parameters w @xmath2, w @xmath3, φ @xmath4.95, w @xmath5. to generate each paraphrase, we set maximum rewrite iterations to be 200, and replace a 3-word span in each iteration. we implement r&r in a 50-sentence batch and apply early-stop when half of the batch are misclassified. we apply rollback operation every 10 steps of rewrite. then, we return the adversarial example with the best critique score. ## related work several recent works proposed word-level adversarial attacks on text classifiers. this type of attack misleads the classifier's predictions by perturbing the words in the input sentence. textfooler @xcite shows the adversarial vulnerability of the state-of-the-art text classifiers. it uses heuristics to replace words with synonyms to mislead the classifier effectively. it relies on several pretrained models, such as word embeddings @xcite , part-of-speech tagger, and universal sentence encoder @xcite to perturb the sentence without changing its meaning. however, simple synonym substitution without considering the context results in unnatural sentences. several works @xcite @xcite address this issue by using masked language models such as bert @xcite to propose more natural word substitutions. our method also belongs to this category. but r&r does not maximize the efficacy of each perturbation, instead it allows exploring combinations of perturbations to generate adversarial examples with high similarity with the original sentence. besides word-level attacks @xcite , there are also character-level attacks which introduce typos to trigger misclassification @xcite @xcite , and sentence-level attacks which attack a classifier by altering the sentence structure @xcite . @xcite gives a comprehensive survey on such attack methods. other work on robustness to adversarial attacks in nlp includes robustness of the machine translation models @xcite , robustness in domain adaptation @xcite , adversarial examples generated by reinforcement learning @xcite , and certified robustness @xcite . adversarial attack libraries @xcite are also developed to help future research. ## conclusion in this paper, we formulate the textual adversarial attack as a multi-objective optimization problem. we use a critique score to synthesize the similarity, fluency, and misclassification objectives, and propose r&r that optimizes the critique score to generate high-quality adversarial examples. we conduct extensive experiments. both automatic and human evaluation show that the proposed method succeeds in optimizing the automatic similarity and fluency metrics to generate adversarial examples of higher quality than previous methods.