Query-Efficient Textual Adversarial Example Generation for Black-Box Attacks (2024)

Abstract: Deep neural networks for Natural Language Processing (NLP) have been demonstrated to be vulnerable to textual adversarial examples. Existing black-box attacks typically require thousands of queries on the target model, making them expensive in real-world applications. In this paper, we propose a new approach that guides the word substitutions using prior knowledge from the training set to improve the attack efficiency. Specifically, we introduce Adversarial Boosting Preference (ABP), a metric that quantifies the importance of words and guides adversarial word substitutions. We then propose two query-efficient attack strategies based on ABP: query-free attack ( ABP_{free} ) and guided search attack ( ABP_{guide} ). Extensive evaluations for text classification demonstrate that ABP_{free} generates more natural adversarial examples than existing universal attacks, ABP_{guide} significantly reduces the number of queries by a factor of 10 500 while achieving comparable or even better performance than black-box attack baselines. Furthermore, we introduce the first ensemble attack ABP_{ens} in NLP, which gains further performance improvements and achieves better transferability and generalization by the ensemble of the ABP across different models and domains. Code is available at https://github.com/BaiDingHub/ABP.

## introduction despite the outstanding performance, deep neural networks (dnns) are known to be vulnerable to adversarial examples @xcite , i.e., imperceptible perturbations on benign samples could lead to entirely incorrect predictions. adversarial examples have brought critical security threats to the widely adopted deep learning based systems, and have attracted enormous attention on adversarial attacks in various domains, e.g. computer * corresponding author. vision (cv) @xcite , natural language processing (nlp) @xcite , etc. textual adversarial attacks pose greater challenges due to the discrete input space and constraints of lexicality, semantics and fluency, which can be categorized into white-box, black-box and universal attacks. white-box attacks @xcite require full access to the victim model, including its architecture, parameters, loss function, gradient, output, etc., which are typically unavailable in real-world applications. black-box attacks @xcite only need access to the model output, e.g., output logits or predictions. however, they require thousands of queries to determine the importance of each word based on the model output, making them expensive in real-world applications. universal attacks @xcite are a particular type of adversarial attacks which adds the same adversarial text generated by the training set at the beginning or end of all input samples to mislead the model. they require no access to the model and usually have a stronger attack efficiency and better usability in the real-world, but lower attack performance and unnatural adversarial examples. in this work, we aim to utilize the prior knowledge learned from the training set to guide word substitutions in black-box attacks to reduce the need to access the model, making it more practical for real-world applications. to this end, we propose adversarial boosting preference (abp), a metric that quantifies the importance of different words and guides the word substitutions. by analyzing statistics of synonym substitutions during adversarial example generation in the training set, we estimate the preference for replacing a word with its synonym in generating adversarial examples, as well as the boosting contribution to the adversariality of these samples, and then multiply them to obtain the score of adversarial boosting preference. based on pre-computed abp from the training set, we propose three query-efficient attacks, including query-free attack abp free , guided search attack abp guide and ensemble attack abp ens . for a benign text, abp free determines the importance of each word, assigns a candidate for each of them, and constructs the replacement order for the text. then abp free substitutes the top 25% words with their respective candidates in the replacement order to generate adversarial examples with no access to the model. abp guide adopts abp to guide the search of adversarial examples, and then prunes redundant perturbations to find the optimal adversary. abp guide significantly improves the attack performance through dozens of queries. finally, abp ens integrates abp generated by different models or domains to further boost the attack performance. to validate the effectiveness, we conduct extensive experiments to compare abp with various black-box attacks @xcite and universal attacks @xcite . empirical evaluations show that abp free generates more natural adversarial examples through synonym substitutions than existing universal attacks. abp guide greatly reduces access to the model than existing black-box attacks, while achieving comparable attack performance. and the ensemble of abp across models and domains gains further performance improvement and achieves superior cross-model transferability and cross-domain generalization. to the best of our knowledge, this is the first ensemble attack method for attacking nlp tasks. ## related work this section briefly introduces the black-box and universal attacks that are moist related to our work. ## methodology in this section, we formalize the problem of text attack, present the definition of abp metric, and provide details of the proposed method. ## experiments to validate the effectiveness of abp, we conduct extensive experiments for text classification.