Evaluating the Validity of Word-level Adversarial Attacks with Large Language Models (2024)

Abstract: Deep neural networks exhibit vulnerability to word-level adversarial attacks in natural language processing. Most of these attack methods adopt synonymous substitutions to perturb original samples for crafting adversarial examples while attempting to maintain semantic consistency with the originals. Some of them claim that they could achieve over 90% attack success rate, thereby raising serious safety concerns. However, our investigation reveals that many purportedly successful adversarial examples are actually invalid due to significant changes in semantic meanings compared to their originals. Even when equipped with semantic constraints such as BERTScore, existing attack methods can generate up to 87.9% invalid adversarial examples. Building on this insight, we first curate a 13K dataset for adversarial validity evaluation with the help of GPT-4. Then, an open-source large language model is fine-tuned to offer an interpretable validity score for assessing the semantic consistency between original and adversarial examples. Finally, this validity score can serve as a guide for existing adversarial attack methods to generate valid adversarial examples. Comprehensive experiments demonstrate the effectiveness of our method in evaluating and refining the quality of adversarial examples.

## introduction despite the success of deep neural networks (dnns) in various natural language processing (nlp) tasks such as text classification, there is a line of research showing the vulnerability of dnns to adversarial attacks @xcite @xcite . these attacks involve introducing human imperceptible perturbations to original sentences, known as adversarial examples, in order to mislead victim models label: prediction: reason: the change from 'best' to 'worst' completely reverses the meaning, turning positive praise into negative criticism. validity score: 1 avllm 𝒙 𝒗𝒂𝒍𝒊𝒅 : it ranks among willams' top screen work. label: prediction: reason: the change from 'best' to 'top' is a synonym substitution that maintains the original meaning. validity score: 5 avllm figure 1 : demonstration of valid and invalid adversarial examples. a word-level attack method perturbs original sample x ori to generate two different adversarial ones: x valid and x invalid . x valid successfully retains its semantic meaning with x ori , representing a valid adversarial example. however, x invalid has a flip in semantic meaning, which fails to preserve semantic consistency to x ori , representing an invalid adversarial example. our avllm can offer scores and explanations of the validity for those generated adversarial examples by cot reasoning. then, validity scores can be used to help judge the success of adversarial attacks. the most effective adversarial attack against text classification dnns is word-level attack, which substitutes a few words to generate perturbed adversarial examples, e.g., synonym substitutions @xcite @xcite @xcite . however, according to investigations in this paper, we find that these attack methods often fail to guarantee high semantic consistency and may even result in semantic flipping. as shown in figure 1 , two adversarial examples x valid and x invalid are generated over original sample x ori with synonymous substitutions. both of them have altered victim model's predictions from to , meeting the first requirement, i.e., misclassification. for the second requirement, i.e., semantic consistency, x valid successfully retains its semantic meaning to x ori ( → ), while x invalid 's meaning significantly changed ( → ) 1 , leaving it an invalid adversarial example and a failed attack. numerous sentence embedding tools, semantic metrics and constraints, like grammar checkers, wordnet @xcite , use @xcite , bertscore @xcite and so on have been applied to adversarial attacks, in order to help word-level attack methods satisfy the semantic consistency requirement. however, as illustrated in at the same time, we find that the validity results offered by @xcite ) (asr g ) are highly consistent with human evaluations, which suggests the impressive ability of large language models (llms) in semantic understanding and evaluation. based on this finding, we propose a 1 that means the ground truth label of xinvalid is actually , and the victim model made a correct prediction of it. ## analysis in this section, we aim to take comprehensive analysis and engage in thorough discussions to study the effectiveness of our method in evaluating and refining the quality of adversarial examples. ## conclusion in this paper, our investigation first reveals a prevalent issue in word-level adversarial attack methods, wherein many of purportedly successful adversarial examples are actually invalid due to the semantic consistency issue. building on this finding, we advocate using llms to offer an interpretable validity score for assessing the semantic consistency between original sample and adversarial example. to this end, we construct a 13k dataset for adversar-ial validity evaluation with the help of gpt-4, and then fine-tune a lightweight llm as avllm for saving costs and boosting the inference speed. the proposed avllm can not only serve as a validity metric to assess the semantic consistency of adversarial examples, but also serve as a plug-and-play patch to help existing attack methods generate highquality and valid adversarial examples. through extensive experiments and analysis, our method demonstrates its efficacy and provides valuable insights for advancing research in adversarial attacks.