Misleading Relation Classifiers by Substituting Words in Texts (2023)

Abstract: Relation classification is to determine the semantic relationship between two entities in a given sentence. However, many relation classifiers are vulnerable to adversarial attacks, which is using adversarial examples to lead victim models to output wrong results. In this paper, we propose a simple but effective method for misleading relation classifiers. We first analyze the most important parts of speech (POSs) from the syntax and morphology perspectives, then we substitute words labeled with these POS tags in original samples with synonyms or hyponyms. Experimental results show that our method can generate adversarial texts of high quality, and most of the relationships between entities can be correctly identified in the process of human evaluation. Furthermore, the adversarial examples generated by our method possess promising transferability, and they are also helpful for improving the robustness of victim models.

## introduction relation extraction (re) is to extract relationships contained in the text. it is an important part of information extraction (ie), and it is widely used in knowledge graph construction, information retrieval, and q&a systems. relation classification is an important link in the process of re, and it aims to predict a relation between two entities in a sentence @xcite . in most cases, the information of entities in samples has already been given (e.g., by manual marking), thus, the effect of relation classification will directly influence the overall performance of re. deep learning (dl) models have advantages in natural language processing (nlp) tasks, but many pre-trained language models are still facing potential threats from adversarial attacks @xcite . to check and further improve the robustness of dl models, there already exist diverse * corresponding author methods to generate adversarial examples currently. moreover, the mechanisms of finding vulnerable places (tokens to be manipulated potentially) in texts and choosing perturbation types (e.g., substitution, insertion, deletion, etc.) are gradually refined. however, some methods @xcite need to rank the importance of each word in finding vulnerable places, and some methods @xcite ignore the characteristics of different parts of speech (poss), so they treat each token in texts equally. most of them need additional prerequisites (such as pre-trained models for word transformation) more or less in the process of implementation, and the essence (some poss are more important than others in nature) of perturbing those words is seldom talked about in these works. in this paper, we present a rule-based method foot_0 for generating adversarial texts against relation classification. we first analyze the most important poss from the perspective of linguistics. to make small changes in original samples and avoid grammar mistakes, our method finds synonyms or hyponyms for tokens labeled with the most important pos tags, and it chooses words that have a great impact on the classification results of victim models. we conduct experiments on 2 datasets and generate adversarial examples against 3 classification models. compared with other related studies, our method can generate samples of higher quality. these adversarial texts preserve the original relationships between entities well (relationships contained in 85.3% of the texts can be correctly judged by all 12 volunteers at the same time), and they also perform well in the experiment that studied transferability. besides, an average of 71.59% adversarial examples can be correctly classified after retraining victim models using updated training sets (containing 5000 adversarial examples). ## related work according to the target of perturbation imposed on input samples, the textual adversarial attacks can be divided into 4 levels @xcite , including character-level, word-level, character/word-level, and sentence-level. character-level. methods @xcite in character-level add perturbations to change the characters of important words. however, texts generated by these methods are usually with more grammar mistakes and are easy to be recognized as adversarial examples by human beings. ## discussions despite our method can generate adversarial examples of high quality, there are still some limitations in this paper. in this section, we talk about the prominent advantage and significant limitations of our method. ## conclusion in this paper, a simple but effective method for generating adversarial examples and misleading relation classifiers is proposed. we first analyze the most important poss from the perspective of linguistics. to reduce modification on original samples and avoid grammar mistakes, our method uses adjusted synonyms or hyponyms to substitute tokens labeled with the most important pos tags. experimental results show the adversarial examples generated by our method have better quality (both evaluated by machines and humans). furthermore, these samples possess promising transferability, and they are also helpful to improve the robustness of victim models. we will further optimize our method and test it in other nlp tasks (e.g., sentiment analysis, textual entailment) in future work. guoyang zeng, fanchao qi, qianrui zhou, tingji zhang, zixian ma, bairu hou, yuan zang, zhiyuan liu, and maosong sun. 2021. openattack: an opensource textual adversarial attack toolkit. in proceedings of the 59th annual meeting of the association for computational linguistics and the 11th international joint conference on natural language processing: system demonstrations, pages 363-371, online. association for computational linguistics. yuhao zhang, victor zhong, danqi chen, gabor angeli, and christopher d. manning. 2017. position-aware attention and supervised data improve slot filling. in proceedings of the 2017 conference on empirical methods in natural language processing, pages 35-45, copenhagen, denmark. association for computational linguistics.