Character-level White-Box Adversarial Attacks against Transformers via Attachable Subwords Substitution (2022)

Abstract: We propose the first character-level white-box adversarial attack method against transformer models. The intuition of our method comes from the observation that words are split into subtokens before being fed into the transformer models and the substitution between two close subtokens has a similar effect with the character modification. Our method mainly contains three steps. First, a gradient-based method is adopted to find the most vulnerable words in the sentence. Then we split the selected words into subtokens to replace the origin tokenization result from the transformer tokenizer. Finally, we utilize an adversarial loss to guide the substitution of attachable subtokens in which the Gumbel-softmax trick is introduced to ensure gradient propagation.Meanwhile, we introduce the visual and length constraint in the optimization process to achieve minimum character modifications.Extensive experiments on both sentence-level and token-level tasks demonstrate that our method could outperform the previous attack methods in terms of success rate and edit distance. Furthermore, human evaluation verifies our adversarial examples could preserve their origin labels.

## introduction adversarial examples are modified input data that could fool the machine learning models but not humans. recently, transformer @xcite based model such as bert @xcite has achieved dominant performance on a wide range of natural language process (nlp) tasks. unfortunately, many works have shown that transformerbased models are vulnerable to adversarial attacks @xcite . on the other hand, the adversarial attack could help improve the robustness of models through adversarial training, which emphasizes the importance of finding high-quality adversarial examples. * † corresponding author. recently, some efficient and effective attacking methods have been proposed at token level (e.g. synonym substitution) @xcite and sentence level (e.g. paraphrasing input texts) @xcite . however, this is not the case in character-level attack methods (e.g. mistyping words), which barely hinder human understanding and is thus a natural attack scenario. most previous methods @xcite achieve the character-level attack in a black box manner, which requires hundreds of attempts and the attack success rate is not good enough. white box attack methods are natural solutions to these drawbacks, but current character-level white box attack methods @xcite only work for models taking characters as input and thus fail on token-level transformer model. achieving character-level white box attack via single character modification is impossible for the transformer model, due to the gradient of characters being unavailable. we choose to implement the character-level attack via subtoken substitution based on the following two observations. (1) nearly all transformer-based pre-training models adopt subword tokenizer @xcite , in which each word is split into subtokens containing one start subtoken and several subtoken attached to it (attachable subtoken). (2) as shown in figure 1 , all character modifications (e.g. swap and insertion) can be achieved by subtoken substitution. based on the above observations, we propose cwba, the first character-level white-box attack method against transformer models via attachable subwords substitution. our method mainly contains three steps: target word selection, adversarial tokenization, and subtoken search. since our cwba requires specific words as input, finding the most vulnerable words is required. our model first ranks the words according to the gradient of words from our adversarial goal. then during the adversarial tokenization process, the topranked words are split into at least three subtokens, including a start subtoken and several attachable subtokens. our cwba method aims to replace these attachable subtokens to achieve character attack. due to the discrete nature of natural languages prohibits the gradient optimization of subtokens, we leverage the gumbel-softmax trick @xcite to sample a continuous distribution from tokens and thus allow gradient propagation. the attachable subtokens are then optimized by a gradient descent method to generate the adversarial example. meanwhile, to minimize the degree of modification, we also introduce visual and length constraints during optimization to make the replaced subtokens visually and length-wise similar. our cwba method could outperform previous attack methods on both sentence level (e.g. sentence classification) and token level (e.g. named entity recognition) tasks in terms of success rate and edit distance. it is worth mentioning that cwba is the first white box attack method applied to token-level tasks. meanwhile, we demonstrate the effectiveness of cwba against various transformer-based models. human evaluation experiments verify our adversarial attack method is label-preserving. finally, the adversarial training experiment shows that training with our adversarial examples would increase the robustness of models. to summarize, the main contributions of our paper are as follows: ## methods in this section, we detail our proposed framework cwba for the character-level white-box attack method. in the following content, we first give a formulation of our attack problem, followed by a detailed description of the three key components: target word selection, adversarial tokenization, and subtoken search. ## experiments we conduct extensive experiments on eight datasets across two tasks (sentence classification and token classification) and four transformer models (bert, roberta, xlnet, and albert) to show the effectiveness of cwba on white-box attack scenarios and give a detailed analysis to show its advantage. ## conclusions in this paper, we propose cwba, the first characterlevel white-box attack method for transformer models. we substitute the attachable subtokens to achieve character modification. the gumbel-softmax technique is adopted to allow gradient propagation. meanwhile, the visual and length constraint help preserve the semantics of adversarial text. experiments on both sentence-level and token-level tasks on various transformer models demonstrate the effectiveness of our method.