Phrase-level Textual Adversarial Attack with Label Preservation (2022)

Abstract: Generating high-quality textual adversarial examples is critical for investigating the pitfalls of natural language processing (NLP) models and further promoting their robustness. Existing attacks are usually realized through word-level or sentence-level perturbations, which either limit the perturbation space or sacrifice fluency and textual quality, both affecting the attack effectiveness. In this paper, we propose Phrase-Level Textual Adversarial ATtack (PLAT) that generates adversarial samples through phrase-level perturbations. PLAT first extracts the vulnerable phrases as attack targets by a syntactic parser, and then perturbs them by a pre-trained blank-infilling model. Such flexible perturbation design substantially expands the search space for more effective attacks without introducing too many modifications, and meanwhile maintaining the textual fluency and grammaticality via contextualized generation using surrounding texts. Moreover, we develop a label preservation filter leveraging the likelihoods of language models fine-tuned on each class, rather than textual similarity, to rule out those perturbations that potentially alter the original class label for humans. Extensive experiments and human evaluation demonstrate that PLAT has a superior attack effectiveness as well as a better label consistency than strong baselines.

## introduction despite the widespread success of deep learning in natural language processing (nlp) applications, a variety of works @xcite @xcite discovered that neural networks can be easily fooled to produce incorrect predictions, when their input text is modified by adversarial attacks that do not necessarily alter human predictions and the true meaning of the original text. through the lens of adversarial attacks, we can allocate the weakness of models and in turn improve their reliability and robustness @xcite . however, generating high-quality adversarial texts is nontrivial due to the discrete nature of human language and its rigorous linguistic structures. while many efforts of previous works have been taken to generate word-level perturbations @xcite @xcite @xcite for the sake of simplicity, their attacks are restricted to independent perturbations on single words and thus cannot produce richer and more diverse forms of adversarial examples. to expand the search space for attacks, sentence-level attacks have been explored @xcite @xcite such as using paraphrasing, but their textual quality is usually poor due to insufficient constraints or controls on the structure and meanings of the generated texts. to generate controllable high-quality textual adversarial examples, we propose a new phrase-level attack, plat, which can explore more diverse and flexible forms of perturbations than single word perturbations. our model is able to produce phraselevel perturbations with a high success rate and preserve the textual similarity in a more controllable manner. as illustrated in figure 1 , with the help of constituency parsing, plat first detects and extracts the most vulnerable phrases from the text to the victim model as the attack targets. to maintain textual fluency and grammaticality, plat perturbs these phrases through a contextualized blank-infilling procedure by a pre-trained language model. compared to existing textual adversarial attacks, plat can produce more effective attacks by searching in a larger space of phrase-level perturbation. meanwhile, plat delicately controls the range and amount of modifications so the textual meaning of the original texts will not be altered significantly after attacks. moreover, the success of attacks can be trivial if allowed to arbitrarily distort the ground-truth label or key contents. hence, a valid attack is required to not change the ground-truth label predicted by humans. however, the semantic similarity filters widely used in existing works to guarantee the validity of adversarial samples @xcite perform unsatisfactorily, especially in preserving the textual meaning and even flip the gold labels according to a recent study @xcite . to this end, we develop a label-preservation filter to maintain class-dependent properties such as sentiments. it is built upon the comparison of likelihoods of language models fine-tuned on different classes' data. thereby, it selects the attacks that can easily fool the victim model but possibly hardly alter the original labels. our contributions in this paper are three-fold: ## methodology in this section, we first formulate the problem of phrase-level textual adversarial attack. then we elaborate on how plat chooses phrase candidates to attack and how to adversarially perturb them. finally, we discuss strategies to select the most effective perturbations with label preservation. ## experiments in this section, we first elaborate on the experimental settings and implementation details of plat as well as the comparisons to several baselines in §3.1. we then introduce the datasets and evaluation designs in §3.2. at the end, we summarize the main results in §3.3. ## analysis in this section, we conduct detailed analyses of plat, including ablation study ( §4.1), discussion of controllability in blank infilling ( §4.2), and attacking robust defense models ( §4.3). ## conclusion we present a new phrase-level textual adversarial attack, plat, which produces richer and higherquality phrase-level perturbations than the widely studied word-level attacks. it utilizes contextualized blank-infilling to generate perturbations by a pre-trained language model and thus well preserves the fluency, and grammaticality. we additionally develop a label-preservation filter based on the likelihood given by class-conditioned language models, trying to to keep the ground-truth labels intact. extensive experiments show the effectiveness of plat and its advantages over baselines on different nlp tasks.