Searching for a Search Method: Benchmarking Search Algorithms for Generating NLP Adversarial Examples (2020)

Abstract: We study the behavior of several black-box search algorithms used for generating adversarial examples for natural language processing (NLP) tasks. We perform a fine-grained analysis of three elements relevant to search: search algorithm, search space, and search budget. When new search algorithms are proposed in past work, the attack search space is often modified alongside the search algorithm. Without ablation studies benchmarking the search algorithm change with the search space held constant, one cannot tell if an increase in attack success rate is a result of an improved search algorithm or a less restrictive search space. Additionally, many previous studies fail to properly consider the search algorithms’ run-time cost, which is essential for downstream tasks like adversarial training. Our experiments provide a reproducible benchmark of search algorithms across a variety of search spaces and query budgets to guide future research in adversarial NLP. Based on our experiments, we recommend greedy attacks with word importance ranking when under a time constraint or attacking long inputs, and either beam search or particle swarm optimization otherwise.

## introduction research has shown that current deep neural network models lack the ability to make correct predictions on adversarial examples @xcite . the field of investigating the adversarial robustness of nlp models has seen growing interest, both in contributing new attack methods 1 for generating adversarial examples @xcite @xcite @xcite and better training strategies to make models resistant to adversaries @xcite . recent studies formulate nlp adversarial attacks as a combinatorial search task and feature the specific search algorithm they use as the key contribution @xcite . the search algorithm aims to perturb a text input with language transformations such as misspellings or synonym substitutions in order to fool a target nlp model when the perturbation adheres to some linguistic constraints (e.g., edit distance, grammar constraint, semantic similarity constraint) @xcite . many search algorithms have been proposed for this process, including varieties of greedy search, beam search, and population-based search. the literature includes a mixture of incomparable and unclear results when comparing search strategies since studies often fail to consider the other two necessary primitives in the search process: the search space (choice of transformation and constraints) and the search budget (in queries to the victim model). the lack of a consistent benchmark on search algorithms has hindered the use of adversarial examples to understand and to improve nlp models. in this work, we attempt to clear the air by answering the following question: which search algorithm should nlp researchers pick for generating nlp adversarial examples? we focus on black-box search algorithms due to their practicality and prevalence in the nlp attack literature. our goal is to understand to what extent the choice of search algorithms matter in generating text adversarial examples and how different search algorithms compare when we hold the search space constant or when we standardize the search cost. we select three families of search algorithms proposed from literature and benchmark their performance on generating adversarial examples for sentiment classification and textual entailment tasks. our main findings can be summarized as the following: ## conclusion the goal of this paper is not to introduce a new method, but to make empirical analysis towards understanding how search algorithms from recent studies contribute in generating natural language adversarial examples. we evaluated six search algorithms on bert-base and lstm models finetuned on three datasets. our results show that when runtime is not a concern, the best-performing methods are beam search and particle swarm optimization. if runtime is of concern, greedy with word importance ranking is the preferable method. we hope that our findings will set a new standard for the reproducibility and evaluation of search algorithms for nlp adversarial examples.