T ext H acker: Learning based Hybrid Local Search Algorithm for Text Hard-label Adversarial Attack (2022)

Abstract: Existing textual adversarial attacks usually utilize the gradient or prediction confidence to generate adversarial examples, making it hard to be deployed in real-world applications. To this end, we consider a rarely investigated but more rigorous setting, namely hard-label attack, in which the attacker can only access the prediction label. In particular, we find we can learn the importance of different words via the change on prediction label caused by word substitutions on the adversarial examples. Based on this observation, we propose a novel adversarial attack, termed Text Hard-label attacker (TextHacker). TextHacker randomly perturbs lots of words to craft an adversarial example. Then, TextHacker adopts a hybrid local search algorithm with the estimation of word importance from the attack history to minimize the adversarial perturbation. Extensive evaluations for text classification and textual entailment show that TextHacker significantly outperforms existing hard-label attacks regarding the attack performance as well as adversary quality.

## introduction despite the unprecedented success of deep neural networks (dnns), they are known to be vulnerable to adversarial examples @xcite , in which imperceptible modification on the correctly classified samples could mislead the model. adversarial examples bring critical security threats to the widely adopted deep learning based systems, attracting enormous attention on adversarial attacks and defenses in various domains, e.g. computer vision (cv) @xcite @xcite and natural language processing (nlp) @xcite @xcite @xcite , etc. ## related work this section briefly introduces the textual adversarial attacks and hybrid local search algorithm. ## methodology in this section, we first introduce the preliminary, symbols and definitions in texthacker, then provide a detailed description of the proposed method. ## experiments in this section, we conduct extensive experiments on eight benchmark datasets and four models to validate the effectiveness of texthacker. ## conclusion in this work, we propose a new text hard-label attack called texthacker. texthacker captures the words that have higher impact on the adversarial example via the changes on prediction label. by incorporating the learned word importance into the search process of the hybrid local search, tex-thacker can reduce the adversarial perturbation between the adversarial example and benign text more efficiently to generate more natural adversarial examples. extensive evaluations for two typical nlp tasks, namely text classification and textual entailment, using various datasets and models demonstrate that texthacker achieves higher attack success rate and lower perturbation rate than existing hard-label attacks and generates higher-quality adversarial examples. we believe that texthacker could shed new light on more precise estimation of the word importance and inspire more researches on hard-label attacks.