A Hybrid Adversarial Attack for Different Application Scenarios
Source abstract
Abstract
Adversarial attack against natural language has been a hot topic in the field of artificial intelligence security in recent years. It is mainly to study the methods and implementation of generating adversarial examples. The purpose is to better deal with the vulnerability and security of deep learning systems. According to whether the attacker understands the deep learning model structure, the adversarial attack is divided into black-box attack and white-box attack. In this paper, we propose a hybrid adversarial attack for different application scenarios. Firstly, we propose a novel black-box attack method of generating adversarial examples to trick the word-level sentiment classifier, which is based on differential evolution (DE) algorithm to generate semantically and syntactically similar adversarial examples. Compared with existing genetic algorithm based adversarial attacks, our algorithm can achieve a higher attack success rate while maintaining a lower word replacement rate. At the 10% word substitution threshold, we have increased the attack success rate from 58.5% to 63%. Secondly, when we understand the model architecture and parameters, etc., we propose a white-box attack with gradient-based perturbation against the same sentiment classifier. In this attack, we use a Euclidean distance and cosine distance combined metric to find the most semantically and syntactically similar substitution, and we introduce the coefficient of variation (CV) factor to control the dispersion of the modified words in the adversarial examples. More dispersed modifications can increase human imperceptibility and text readability. Compared with the existing global attack, our attack can increase the attack success rate and make modification positions in generated examples more dispersed. We’ve increased the global search success rate from 75.8% to 85.8%. Finally, we can deal with different application scenarios by using these two attack methods, that is, whether we understand the internal structure and parameters of the model, we can all generate good adversarial examples.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Advanced Malware Detection Techniques · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China
References (26)
Show source-provided references
1. Szegedy, C., Zaremba, W., Sutskever, I., Estrach, J.B., Erhan, D., Goodfellow, I., and Fergus, R. (2014, January 14–16). Intriguing properties of neural networks. Proceedings of the 2nd International Conference on Learning Representations (ICLR 2014), Banff, AB, Canada.
2. Kurakin, A., Goodfellow, I.J., and Bengio, S. (2018). Adversarial Examples in the Physical World. Artificial Intelligence Safety and Security, Chapman and Hall/CRC.10.1201/9781351251389-8 ↗
3. Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. (2018, January 18–22). Boosting adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Salt Lake City, UT, USA.10.1109/CVPR.2018.00957 ↗
4. Liang, B., Li, H., Su, M., Bian, P., Li, X., and Shi, W. (2018, January 13–19). Deep text classification can be fooled. Proceedings of the 27th International Joint Conference on Artificial Intelligence, Stockholm, Sweden.10.24963/ijcai.2018/585 ↗
5. Alzantot, M., Sharma, Y.S., Elgohary, A., Ho, B.J., Srivastava, M., and Chang, K.W. (November, January 31). Generating Natural Language Adversarial Examples. Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, Brussels, Belgium.10.18653/v1/D18-1316 ↗
6. Wang, X., Jin, H., and He, K. (2019). Natural language adversarial attacks and defenses in word level. arXiv.
7. One pixel attack for fooling deep neural networks10.1109/TEVC.2019.2890858 ↗
8. Yang, P., Chen, J., Hsieh, C.J., Wang, J.L., and Jordan, M.I. (2018). Greedy attack and gumbel attack: Generating adversarial examples for discrete data. arXiv.
9. Tsai, Y.T., Yang, M.C., and Chen, H.Y. (Augusy, January 28). Adversarial Attack on Sentiment Classification. Proceedings of the 2019 ACL Workshop BlackboxNLP: Analyzing and Interpreting Neural Networks for NLP, Florence, Italy.10.18653/v1/W19-4824 ↗
10. Jia, R., and Liang, P. (2017, January 7–11). Adversarial Examples for Evaluating Reading Comprehension Systems. Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, Copenhagen, Denmark.10.18653/v1/D17-1215 ↗
11. Wang, Y., and Bansal, M. (2018, January 1–6). Robust Machine Comprehension Models via Adversarial Training. Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 (Short Papers), New Orleans, LA, USA.10.18653/v1/N18-2091 ↗
12. Belinkov, Y., and Bisk, Y. (2017). Synthetic and natural noise both break neural machine translation. arXiv.
13. Gao, J., Lanchantin, J., Soffa, M.L., and Qi, Y. (2018). Black-Box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers, IEEE.10.1109/SPW.2018.00016 ↗
14. Ren, S., Deng, Y., He, K., and Che, W. Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency. Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, Florence, Italy, 28 July–2 Augusy 2019.10.18653/v1/P19-1103 ↗
15. Jin, D., Jin, Z., Zhou, J.T., and Szolovits, P. (2020). Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment. arXiv.10.1609/aaai.v34i05.6311 ↗
16. Ebrahimi, J., Rao, A., Lowd, D., and Dou, D. (2018, January 15–20). HotFlip: White-Box Adversarial Examples for Text Classification. Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), Melbourne, Australia.10.18653/v1/P18-2006 ↗
17. Cheng, Y., Jiang, L., and Macherey, W. (August, January 28). Robust Neural Machine Translation with Doubly Adversarial Inputs. Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, Florence, Italy.
18. Kuleshov, V., Thakoor, S., Lau, T., and Ermon, S. (2020, May 20). Adversarial Examples for Natural Language Classification Problems. Available online: https://openreview.net/forum?id=r1QZ3zbAZ.
19. Lei, Q., Wu, L., Chen, P.Y., Dimakis, A., Dhillon, I., and Witbrock, M. (2018). Discrete Adversarial Attacks and Submodular Optimization with Applications to Text Classification. arXiv.
20. Zhang, W.E., Sheng, Q.Z., Alhazmi, A., and Li, C. (2019). Adversarial attacks on deep learning models in natural language processing: A survey. arXiv.
21. Wang, W., Tang, B., Wang, R., Wang, L., and Ye, A. (2019). A survey on Adversarial Attacks and Defenses in Text. arXiv.
22. Kusner, M., Sun, Y., Kolkin, N., and Weinberger, K. (2015, January 6–11). From word embeddings to document distances. Proceedings of the International Conference on Machine Learning, Lille, France.
23. Rubner, Y., Tomasi, C., and Guibas, L.J. (1998). A Metric for Distributions with Applications to Image Databases, IEEE.
24. Mrkšic, N., OSéaghdha, D., Thomson, B., Gašic, M., Rojas-Barahona, L., Su, P.H., Vandyke, D., Wen, T.H., and Young, S. (2016, January 12–17). Counter-fitting Word Vectors to Linguistic Constraints. Proceedings of the NAACL-HLT, Atlanta, GA, USA.10.18653/v1/N16-1018 ↗
25. Chelba, C., Mikolov, T., Schuster, M., Ge, Q., Brants, T., Koehn, P., and Robinson, T. (2013). One billion word benchmark for measuring progress in statistical language modeling. arXiv.10.21437/Interspeech.2014-564 ↗
26. Kim, Y. (2014, January 25–29). Convolutional Neural Networks for Sentence Classification. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), Doha, Qatar.10.3115/v1/D14-1181 ↗