Contextualized Perturbation for Textual Adversarial Attack

Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 5053–5069 June 6–11, 2021. ©2021 Association for Computational Linguistics 5053 Contextualized Perturbation for Textual Adversarial Attack Dianqi Li♠ Yizhe Zhang♦ Hao Peng♠ Liqun Chen♣ Chris Brockett♦ Ming-Ting Sun♠ Bill Dolan♦ ♠University of Washington ♦Microsoft Research ♣Duke University {dianqili, mts}@uw.edu, hapeng@cs.uw.edu, liqun.chen@duke.edu {Yizhe.Zhang, Chris.Brockett, billdol}@microsoft.com Abstract Adversarial examples expose the vulnerabil- ities of natural language processing (NLP) models, and can be used to evaluate and im- prove their robustness. Existing techniques of generating such examples are typically driven by local heuristic rules that are ag- nostic to the context, often resulting in un- natural and ungrammatical outputs. This paper presents CLARE, a ContextuaLized AdversaRial Example generation model that produces fluent and grammatical outputs through a mask-then-infill procedure. CLARE builds on a pre-trained masked language model and modifies the inputs in a context- aware manner. We propose three contextual- ized perturbations, Replace, Insert and Merge, that allow for generating outputs of varied lengths. CLARE can flexibly combine these perturbations and apply them at any position in the inputs, and is thus able to attack the victim model more effectively with fewer ed- its. Extensive experiments and human evalua- tion demonstrate that CLARE outperforms the baselines in terms of attack success rate, tex- tual similarity, fluency and grammaticality. 1 Introduction Adversarial example generation for natural lan- guage processing (NLP) tasks aims to perturb input text to trigger errors in machine learning models, while keeping the output close to the original. Be- sides exposing system vulnerabilities and helping improve their robustness and security (Zhao et al., 2018; Wallace et al., 2019; Cheng et al., 2019; Jia et al., 2019, inter alia), adversarial examples are also used to analyze and interpret the models’ deci- sions (Jia and Liang, 2017; Ribeiro et al., 2018). Generating adversarial examples for NLP tasks can be challenging, in part due to the discrete nature of natural language text. Most recent efforts have explored heuristic rules, such as replacing tokens with their synonyms (Samanta and Mehta, 2017; Super ant colony hits Australia {Coast, , }. A {gigantic, , } 100km colony of ants could threaten {insect, , } species. Super ant colony hits Australia . A giant 100km colony of ants could threaten local insect species. CLARE: Contextualized Perturbation Original Text Adversarial Text Figure 1: Illustration of CLARE. Through a mask-then- infill procedure, the model generates the adversarial text with three contextualized perturbations: Replace, Insert and Merge. A mask is indicated by “ ”. The degree of fade corresponds to the (decreasing) priority of the infill tokens. Liang et al., 2019; Alzantot et al., 2018; Ren et al., 2019; Jin et al., 2020, inter alia). Despite some empirical success, rule-based methods are agnostic to context, limiting their ability to produce natu- ral, fluent, and grammatical outputs (Wang et al., 2019b; Kurita et al., 2020, inter alia). This work presents CLARE, a ContextuaLized AdversaRial Example generation model for text. CLARE perturbs the …

Content truncated to 500 words