S em A ttack: Natural Textual Attacks via Different Semantic Spaces (2022)

Abstract: Recent studies show that pre-trained language models (LMs) are vulnerable to textual adversarial attacks. However, existing attack methods either suffer from low attack success rates or fail to search efficiently in the exponentially large perturbation space. We propose an efficient and effective framework SemAttack to generate natural adversarial text by constructing different semantic perturbation functions. In particular, SemAttack optimizes the generated perturbations constrained on generic semantic spaces, including typo space, knowledge space (e.g., WordNet), contextualized semantic space (e.g., the embedding space of BERT clusterings), or the combination of these spaces. Thus, the generated adversarial texts are more semantically close to the original inputs. Extensive experiments reveal that state-of-the-art (SOTA) large-scale LMs (e.g., DeBERTa-v2) and defense strategies (e.g., FreeLB) are still vulnerable to SemAttack. We further demonstrate that SemAttack is general and able to generate natural adversarial texts for different languages (e.g., English and Chinese) with high attack success rates. Human evaluations also confirm that our generated adversarial texts are natural and barely affect human performance. Our code is publicly available at https://github.com/AI-secure/SemAttack .

## introduction deep neural networks have achieved remarkable success in many machine learning tasks. particularly, bert @xcite has inspired a suite of large-scale pre-trained language models @xcite @xcite , which achieved new sota for many nlp tasks. in addition to bert's dominant performance on english datasets, @xcite points out that bert is similarly effective on other languages ## experimental results in this section, we conduct comprehensive experiments to evaluate our attack method in various settings. we first apply our attack method to two standard nlp models, bert and sota self-attention lstm. we evaluate on two different types of nlp tasks, sentiment analysis and natural language inference (nli). secondly, we investigate the effectiveness of semattack against sota large-scale language models and defense methods. thirdly, we take chinese as an example to measure semattack's generalization ability across different languages. we evaluate bert models finetuned on two chinese datasets. finally, we conduct extensive human evaluations on both english and chinese datasets. we find that: 1) semattack can achieve better attack success rates than existing textual adversarial attack methods with better language quality and adversarial transferability. 2) sota lms and defense methods are still vulnerable to our semattack. ## related work our proposed semantic perturbation functions generalize the existing textual adversarial attacks. for typo-based perturbation function f t , existing work @xcite applies character-level perturbation to carefully crafted typo words (e.g., from "foolish" to "fo0lish"), thus making the model ignore or misunderstand the original statistical cues. knowledge-based perturbation function f k uses knowledge base to constrain the search space. for example, @xcite uses sememe-based knowledge base from hownet @xcite to construct a search space for word substitution. different from our contextualized semantic perturbation function f c , other work @xcite uses a non-contextualized word embedding from glove @xcite or word2vec @xcite to build synonym candidates, by querying the cosine similarity or eu-clidean distance between the original and candidate word and selecting the closet ones as the replacements. however, some antonyms also have high cosine similarity in the word2vec space. thus, additional hand-crafted filtering rules are needed to ensure that the meaning is not changed. other work @xcite @xcite also leverages pre-trained models to generate contextualized perturbations by masked language modeling, which is a parallel work to semattack, where we explore the bert embedding clusters to generate high-quality adversarial examples. in terms of optimization, unlike the heuristicbased previous work that uses greedy @xcite or genetic algorithms @xcite which search for the optimal perturbations, or gradient-based methods @xcite which search for perturbation on a tree-autoencoder with only syntactic constraints or a distribution of adversarial examples, we use an optimization-based method to efficiently and effectively search for the optimal adversarial perturbation in the semantic preserving spaces to ensure the validity and naturalness of perturbed sentences. ## conclusion in this paper, we propose a novel semantic adversarial attack framework semattack to probe the robustness of lms. comprehensive experiments show that semattack is able to generate natural adversarial texts in different languages and achieve higher attack success rates than existing textual attacks. we also demonstrate that existing sota lms and defense methods are still vulnerable to semattack. we expect our study to shed light on future research on evaluating and enhancing the robustness of lms for different languages.