Bridge the Gap Between CV and NLP ! A Gradient-based Textual Adversarial Attack Framework (2023)

Abstract: Despite recent success on various tasks, deep learning techniques still perform poorly on adversarial examples with small perturbations. While optimization-based methods for adversarial attacks are well-explored in the field of computer vision, it is impractical to directly apply them in natural language processing due to the discrete nature of the text. To address the problem, we propose a unified framework to extend the existing optimization-based adversarial attack methods in the vision domain to craft textual adversarial samples. In this framework, continuously optimized perturbations are added to the embedding layer and amplified in the forward propagation process. Then the final perturbed latent representations are decoded with a masked language model head to obtain potential adversarial samples. In this paper, we instantiate our framework with an attack algorithm named Textual Projected Gradient Descent (T-PGD). We find our algorithm effective even using proxy gradient information. Therefore, we perform the more challenging transfer black-box attack and conduct comprehensive experiments to evaluate our attack algorithm with several models on three benchmark datasets. Experimental results demonstrate that our method achieves overall better performance and produces more fluent and grammatical adversarial samples compared to strong baseline methods. The code and data are available at https://github.com/Phantivia/T-PGD .

## introduction despite great success in real-world applications, deep neural networks (dnns) are still vulnerable to adversarial samples, which are crafted by adding small and human-imperceptible perturbations to the inputs and can change the prediction ## framework in this section, we first present an overview of our framework, and next, we will give the details of how to add continuous perturbations and reconstruct the text. ## experiments we conduct comprehensive experiments to evaluate our general framework and t-pgd algorithm on the task of sentiment analysis, natural language inference, and news classification. we consider both automatic and human evaluations to analyze our method in terms of attack performance, semantic consistency, and grammaticality. ## further analysis importance of gradient information. t-pgd employs the gradient of the proxy local bert model to approximate the perturbations. to verify the effectiveness of the gradient information, we conduct an ablation experiment on sst-2 by adding only random perturbations in the embedding space without exploiting the gradient information. in detail, we generate a gaussian noise with the same mean and variance as our gradient-based perturbations. the results in importance of reconstruction task. we show the importance of adding a reconstruction loss (l 2 in eq.( 5 )) for generating more accurate reconstructions. we conduct an ablation study on sst-2. the results are shown in ## conclusion and future work in this paper, we propose a general framework to facilitate generating discrete adversarial texts using optimization-based methods. in our framework, the problem of searching textual adversarial samples in discrete text space is transformed into the continuous embedding space, where the perturbation can be optimized by gradient information, as explored in cv. the perturbations in embeddings will be amplified in the forward propagation process, then decoded by an mlm head from the latent representations. we instantiate our framework with t-pgd, where the gradient comes from the local proxy model instead of the true victim model, i.e.