Contextualized Perturbation for Textual Adversarial Attack (2021)

Abstract: Adversarial examples expose the vulnerabilities of natural language processing (NLP) models, and can be used to evaluate and improve their robustness. Existing techniques of generating such examples are typically driven by local heuristic rules that are agnostic to the context, often resulting in unnatural and ungrammatical outputs. This paper presents CLARE, a ContextuaLized AdversaRial Example generation model that produces fluent and grammatical outputs through a mask-then-infill procedure. CLARE builds on a pre-trained masked language model and modifies the inputs in a context-aware manner. We propose three contextualized perturbations, Replace, Insert and Merge, that allow for generating outputs of varied lengths. CLARE can flexibly combine these perturbations and apply them at any position in the inputs, and is thus able to attack the victim model more effectively with fewer edits. Extensive experiments and human evaluation demonstrate that CLARE outperforms the baselines in terms of attack success rate, textual similarity, fluency and grammaticality.

## introduction adversarial example generation for natural language processing (nlp) tasks aims to perturb input text to trigger errors in machine learning models, while keeping the output close to the original. besides exposing system vulnerabilities and helping improve their robustness and security @xcite @xcite , adversarial examples are also used to analyze and interpret the models' decisions @xcite . generating adversarial examples for nlp tasks can be challenging, in part due to the discrete nature of natural language text. most recent efforts have explored heuristic rules, such as replacing tokens with their synonyms @xcite super ant colony hits australia {coast, , }. a {gigantic, , } 100km colony of ants could threaten {insect, , } species. super ant colony hits australia . a giant 100km colony of ants could threaten local insect species. ## clare at a high level, clare applies a sequence of contextualized perturbation actions to the input. each can be seen as a local mask-then-infill procedure: it first applies a mask to the input around a given position, and then fills it in using a pretrained masked language model ( §2.1). to produce the output, clare scores and descendingly ranks the actions, which are then iteratively applied to the input ( §2.2). we begin with a brief background review and laying out of necessary notation. ## experiments we evaluate clare on text classification, natural language inference, and sentence paraphrase tasks. we begin by describing the implementation details of clare and the baselines ( §3.1). §3.2 introduces the experimental datasets and the evaluation metrics; the results are summarized in §3.3. ## analysis this section first conducts an ablation study ( §4.1). we then explore clare's potential to be used to improve downstream models' robustness and accuracy in §4.3. in §4.2, we empirically observe that clare tends to attack noun and noun phrases. ## conclusion we have presented clare, a contextualized adversarial example generation model for text. it uses contextualized knowledge from pretrained masked language models, and can generate adversarial examples that are natural, fluent and grammatical. with three contextualized perturbation patterns, replace, insert and merge in our arsenal, clare can produce outputs of varied lengths and achieves a higher attack success rate than baselines and with fewer edits. human evaluation shows significant advantages of clare in terms of textual similarity, fluency and grammaticality. we release our code and models at https://github.com/cookielee77/clare . dataset avg. length # classes train test acc sst-2 10 2 67k 0.9k 92.3% dbpedia 55 14 560k 70k 99.3% qqp 13/13 2 363k 40k 91.4% mrpc 23/23 2 3.6k 1.7k 81.4%