Universal Adversarial Attack via Conditional Sampling for Text Classification
Source abstract
Abstract
Despite deep neural networks (DNNs) having achieved impressive performance in various domains, it has been revealed that DNNs are vulnerable in the face of adversarial examples, which are maliciously crafted by adding human-imperceptible perturbations to an original sample to cause the wrong output by the DNNs. Encouraged by numerous researches on adversarial examples for computer vision, there has been growing interest in designing adversarial attacks for Natural Language Processing (NLP) tasks. However, the adversarial attacking for NLP is challenging because text is discrete data and a small perturbation can bring a notable shift to the original input. In this paper, we propose a novel method, based on conditional BERT sampling with multiple standards, for generating universal adversarial perturbations: input-agnostic of words that can be concatenated to any input in order to produce a specific prediction. Our universal adversarial attack can create an appearance closer to natural phrases and yet fool sentiment classifiers when added to benign inputs. Based on automatic detection metrics and human evaluations, the adversarial attack we developed dramatically reduces the accuracy of the model on classification tasks, and the trigger is less easily distinguished from natural text. Experimental results demonstrate that our method crafts more high-quality adversarial examples as compared to baseline methods. Further experiments show that our method has high transferability. Our goal is to prove that adversarial attacks are more difficult to detect than previously thought and enable appropriate defenses.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Advanced Malware Detection Techniques · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Institute of Electronic Countermeasure, National University of Defense Technology, Hefei 230000, China
Funding
Natural Science Foundation of Anhui Province
References (30)
Show source-provided references
1. Krizhevsky, A., Sutskever, I., and Hinton, G.E. (2012, January 3–6). ImageNet Classification with Deep Convolutional Neural Networks. Proceedings of the Advances in Neural Information Processing Systems 25: 26th Annual Conference on Neural Information Processing Systems 2012, Lake Tahoe, NV, USA.
2. Ye, F., and Yang, J. (2021). A Deep Neural Network Model for Speaker Identification. Appl. Sci., 11.10.3390/app11083603 ↗
3. Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2019). BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. arXiv.
4. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014). Intriguing properties of neural networks. arXiv.
5. Papernot, N., McDaniel, P., Swami, A., and Harang, R. (2016). Crafting Adversarial Input Sequences for Recurrent Neural Networks. arXiv.10.1109/MILCOM.2016.7795300 ↗
6. Du, X., Yu, J., Yi, Z., Li, S., Ma, J., Tan, Y., and Wu, Q. (2020). A Hybrid Adversarial Attack for Different Application Scenarios. Appl. Sci., 10.10.3390/app10103559 ↗
7. Thys, S., Van Ranst, W., and Goedeme, T. (2019, January 16–20). Fooling Automated Surveillance Cameras: Adversarial Patches to Attack Person Detection. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, Workshops 2019, Long Beach, CA, USA.10.1109/CVPRW.2019.00012 ↗
8. Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., and Swami, A. (2015). The Limitations of Deep Learning in Adversarial Settings. arXiv.10.1109/EuroSP.2016.36 ↗
9. Jia, R., and Liang, P. (2017). Adversarial Examples for Evaluating Reading Comprehension Systems. arXiv.10.18653/v1/D17-1215 ↗
10. Belinkov, Y., and Bisk, Y. (2018). Synthetic and Natural Noise Both Break Neural Machine Translation. arXiv.
11. Moosavi-Dezfooli, S., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21–26). Universal Adversarial Perturbations. Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA.10.1109/CVPR.2017.17 ↗
12. Inui, K., Jiang, J., Ng, V., and Wan, X. (2019, January 3–7). Universal Adversarial Triggers for Attacking and Analyzing NLP. Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, EMNLP-IJCNLP 2019, Hong Kong, China.
13. Behjati, M., Moosavi-Dezfooli, S., Baghshah, M.S., and Frossard, P. (2019, January 12–17). Universal Adversarial Attacks on Text Classifiers. Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing, ICASSP 2019, Brighton, UK.10.1109/ICASSP.2019.8682430 ↗
14. Language Models are Unsupervised Multitask Learners
15. Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., and Stoyanov, V. (2019). RoBERTa: A Robustly Optimized BERT Pretraining Approach. arXiv.
16. Wallach, H.M., Larochelle, H., Beygelzimer, A., d’Alché-Buc, F., Fox, E.B., and Garnett, R. (2019, January 8–14). XLNet: Generalized Autoregressive Pretraining for Language Understanding. Proceedings of the Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, Vancouver, BC, Canada.
17. Wang, A., Singh, A., Michael, J., Hill, F., Levy, O., and Bowman, S.R. (2019, January 6–9). GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understanding. Proceedings of the 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA.
18. Wallach, H.M., Larochelle, H., Beygelzimer, A., d’Alché-Buc, F., Fox, E.B., and Garnett, R. (2019, January 8–14). SuperGLUE: A Stickier Benchmark for General-Purpose Language Understanding Systems. Proceedings of the Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, Vancouver, BC, Canada.
19. Wang, A., and Cho, K. (2019). BERT has a Mouth, and It Must Speak: BERT as a Markov Random Field Language Model. arXiv.
20. Ebrahimi, J., Rao, A., Lowd, D., and Dou, D. (2018). HotFlip: White-Box Adversarial Examples for Text Classification. arXiv.10.18653/v1/P18-2006 ↗
21. Lei, Q., Wu, L., Chen, P., Dimakis, A., Dhillon, I.S., and Witbrock, M.J. (2, January 31). Discrete Adversarial Attacks and Submodular Optimization with Applications to Text Classification. Proceedings of the Machine Learning and Systems 2019, MLSys 2019, Stanford, CA, USA.
22. Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.J., Srivastava, M., and Chang, K.W. (2018). Generating Natural Language Adversarial Examples. arXiv.10.18653/v1/D18-1316 ↗
23. Zang, Y., Qi, F., Yang, C., Liu, Z., Zhang, M., Liu, Q., and Sun, M. (2020, January 5–10). Word-level Textual Adversarial Attacking as Combinatorial Optimization. Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Online.10.18653/v1/2020.acl-main.540 ↗
24. Brown, T.B., Mané, D., Roy, A., Abadi, M., and Gilmer, J. (2017). Adversarial Patch. arXiv.
25. Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C.D., Ng, A., and Potts, C. (2013, January 18–21). Recursive Deep Models for Semantic Compositionality Over a Sentiment Treebank. Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, Seattle, WA, USA.
26. Maas, A.L., Daly, R.E., Pham, P.T., Huang, D., Ng, A.Y., and Potts, C. (2011). Learning Word Vectors for Sentiment Analysis. Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies—Volume 1, Association for Computational Linguistics.
27. Moschitti, A., Pang, B., and Daelemans, W. (2014, January 25–29). Glove: Global Vectors for Word Representation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing, EMNLP 2014, Doha, Qatar. A Meeting of SIGDAT, a Special Interest Group of the ACL.
28. Wallace, E., Feng, S., Kandpal, N., Gardner, M., and Singh, S. (2021). Universal Adversarial Triggers for Attacking and Analyzing NLP. arXiv.
29. Merlo, P., Tiedemann, J., and Tsarfaty, R. (2021, January 19–23). Frequency-Guided Word Substitutions for Detecting Textual Adversarial Examples. Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume, EACL 2021, Online.
30. Kurakin, A., Goodfellow, I.J., and Bengio, S. (2017, January 24–26). Adversarial examples in the physical world. Proceedings of the 5th International Conference on Learning Representations, ICLR 2017, Toulon, France.