Word-level Textual Adversarial Attacking as Combinatorial Optimization (2020)

Abstract: Adversarial attacks are carried out to reveal the vulnerability of deep neural networks. Textual adversarial attacking is challenging because text is discrete and a small perturbation can bring significant change to the original input. Word-level attacking, which can be regarded as a combinatorial optimization problem, is a well-studied class of textual attack methods. However, existing word-level attack models are far from perfect, largely because unsuitable search space reduction methods and inefficient optimization algorithms are employed. In this paper, we propose a novel attack model, which incorporates the sememe-based word substitution method and particle swarm optimization-based search algorithm to solve the two problems separately. We conduct exhaustive experiments to evaluate our attack model by attacking BiLSTM and BERT on three benchmark datasets. Experimental results demonstrate that our model consistently achieves much higher attack success rates and crafts more high-quality adversarial examples as compared to baseline methods. Also, further experiments show our model has higher transferability and can bring more robustness enhancement to victim models by adversarial training. All the code and data of this paper can be obtained on https://github.com/thunlp/SememePSO-Attack .

## introduction adversarial attacks use adversarial examples @xcite , which are maliciously crafted by perturbing the original input, to fool the deep neural networks * indicates equal contribution. yuan developed the method, designed and conducted most experiments; fanchao formalized the task, designed some experiments and wrote the paper; chenghao made the original research proposal, performed human evaluation and conducted some experiments. textual adversarial attacking is challenging. different from images, a truly imperceptible perturbation on text is almost impossible because of its discrete nature. even a slightest character-level perturbation can either (1) change the meaning and, worse still, the true label of the original input, or (2) break its grammaticality and naturality. unfortunately, the change of true label will make the adversarial attack invalid. for example, supposing an adversary changes "she" to "he" in an input sentence to attack a gender identification model, although the victim model alters its prediction result, this is not a valid attack. and the adversarial examples with broken grammaticality and naturality (i.e., poor quality) can be easily defended @xcite . various textual adversarial attack models have been proposed @xcite , ranging from character-level flipping @xcite to sentence-level paraphrasing @xcite . among them, word-level attack models, mostly word substitution-based models, perform comparatively well on both attack efficiency and adversarial example quality @xcite . word-level adversarial attacking is actually a problem of combinatorial optimization @xcite , as its goal is to craft adversarial examples which can successfully fool the victim model using a limited vocabulary. in this paper, as shown in figure 1 , we break this combinatorial optimization problem down into two steps including (1) reducing search space and (2) searching for adversarial examples. the first step is aimed at excluding invalid or low-quality potential adversarial examples and retaining the valid ones with good grammaticality and naturality. the most common manner is to pick some candidate substitutes for each word in the original input and use their combinations as the reduced discrete search space. however, existing attack models either disregard this step @xcite or adopt unsatisfactory substitution methods that do not perform well in the trade-off between quality and quantity of the retained adversarial examples @xcite . the second step is supposed to find adversarial examples that can successfully fool the victim model in the reduced search space. previous studies have explored diverse search algorithms including gradient descent @xcite , genetic algorithm @xcite and greedy algorithm @xcite . some of them like gradient descent only work in the white-box setting where full knowledge of the victim model is required. in real situations, however, we usually have no access to the internal structures of victim models. as for the other black-box algorithms, they are not efficient and effective enough in searching for adversarial examples. these problems negatively affect the overall attack performance of existing word-level adversar-ial attacking. to solve the problems, we propose a novel black-box word-level adversarial attack model, which reforms both the two steps. in the first step, we design a word substitution method based on sememes, the minimum semantic units, which can retain more potential valid adversarial examples with high quality. in the second step, we present a search algorithm based on particle swarm optimization @xcite , which is very efficient and performs better in finding adversarial examples. we conduct exhaustive experiments to evaluate our model. experimental results show that, compared with baseline models, our model not only achieves the highest attack success rate (e.g., 100% when attacking bilstm on imdb) but also possesses the best adversarial example quality and comparable attack validity. we also conduct decomposition analyses to manifest the advantages of the two parts of our model separately. finally, we demonstrate that our model has the highest transferability and can bring the most robustness improvement to victim models by adversarial training. ## background in this section, we first briefly introduce sememes, and then we give an overview of the classical particle swarm optimization algorithm. ## methodology in this section, we detail our word-level adversarial attack model. it incorporates two parts, namely the sememe-based word substitution method and pso-based adversarial example search algorithm. ## experiments in this section, we conduct comprehensive experiments to evaluate our attack model on the tasks of sentiment analysis and natural language inference. ## related work existing textual adversarial attack models can be classified into three categories according to the perturbation levels of their adversarial examples. sentence-level attacks include adding distracting sentences @xcite , paraphrasing @xcite and performing perturbations in the continuous latent semantic space @xcite . adversarial examples crafted by these methods usually have profoundly different forms from original input and their validity are not guaranteed. character-level attacks are mainly random character manipulations including swap, substitution, deletion, insertion and repeating @xcite @xcite . in addition, gradient-based character substitution methods have also been explored, with the help of one-hot character embeddings @xcite or visual character embeddings @xcite . although character-level attacks can achieve high success rates, they break the grammaticality and naturality of original input and can be easily defended @xcite . 6 for instance, using embedding/lm+genetic in adversarial training to defend its attack declines the attack success rate by 2.60% while using our sememe+pso model declines by 3.53%. att \adv.t none e/l+g syn+g sem+p sem+p* e/l+g 67.70 -2.60 -0.60 -3.53 -5.10 syn+g 73.30 -2.67 -3.50 -3.13 -3.53 sem+p 93.80 -1.07 0.03 -2.93 -4.33 as for word-level attacks, following our twostep modeling, their adversarial example space reduction methods (step 1) involve using word embeddings @xcite or language model @xcite to filter words, selecting synonyms as substitutes @xcite @xcite , and their combinations @xcite . the search algorithms (step 2) include gradient descent @xcite @xcite , genetic algorithm @xcite , metropolis-hastings sampling @xcite , saliency-based greedy algorithm @xcite @xcite . in comparison, our model adopts new methods in both steps which are more powerful. ## conclusion and future work in this paper, we propose a novel word-level attack model comprising the sememe-based word substitution method and particle swarm optimization-based search algorithm. we conduct extensive experiments to demonstrate the superiority of our model in terms of attack success rate, adversarial example quality, transferability and robustness improvement to victim models by adversarial training. in the future, we will try to increase the robustness gains of adversarial training and consider utilizing sememes in adversarial defense model.