From Hero to Zéroe: A Benchmark of Low-Level Adversarial Attacks

Proceedings of the 1st Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 10th International Joint Conference on Natural Language Processing, pages 786–803 December 4 - 7, 2020. c⃝2020 Association for Computational Linguistics 786 From Hero to Z´eroe: A Benchmark of Low-Level Adversarial Attacks Steffen Eger and Yannik Benz Computer Science Department Technische Universit¨at Darmstadt, Germany eger@aiphes.tu-darmstadt.de, yannik.benz@stud.tu-darmstadt.de Abstract Adversarial attacks are label-preserving mod- ifications to inputs of machine learning clas- sifiers designed to fool machines but not hu- mans. Natural Language Processing (NLP) has mostly focused on high-level attack sce- narios such as paraphrasing input texts. We argue that these are less realistic in typical application scenarios such as in social me- dia, and instead focus on low-level attacks on the character-level. Guided by human cogni- tive abilities and human robustness, we pro- pose the first large-scale catalogue and bench- mark of low-level adversarial attacks, which we dub Z´eroe, encompassing nine different at- tack modes including visual and phonetic ad- versaries. We show that RoBERTa, NLP’s current workhorse, fails on our attacks. Our dataset provides a benchmark for testing ro- bustness of future more human-like NLP mod- els. 1 Introduction Adversarial examples are label-preserving modifi- cations to inputs of machine learning architectures. Their typical characteristic is that they cause little damage to humans but may maximally affect clas- sifier performance, exposing their weaknesses and outlining the differences between human and ma- chine text processing (Szegedy et al., 2014; Good- fellow et al., 2014; Eger et al., 2019). While in computer vision, pixel-level attacks, which go unnoticed by humans, may lead to catas- trophic failure, attacks in NLP are more chal- lenging. Some attacks in NLP replace individual words by synonyms or hyponyms (Alzantot et al., 2018) or paraphrase whole sentences (Ribeiro et al., 2018). However, such high-level attacks are not only more difficult to compute (requiring available resources such as dictionaries or word embeddings) but they are also implausible in real-world scenar- ios such as spamming or posting in social media, as users would need to know the training data and/or the inner workings of the machine learning mod- els in order to identify candidate substitutions (or have unrestrained access to model predictions). In contrast, such users would typically use low-level attacks on characters, such as inserting placeholder symbols (e.g., underscores), mistyping words (e.g., Hilter for Hitler), or using phonetically similar sounding words (Tagg, 2011) to fool online de- tection models. To identify plausible such attack scenarios, human perceptual abilities play a deci- sive role. For instance, humans are guided by their senses, making them robust to, e.g., visual and pho- netic attacks. Other scenarios to which humans have been shown robust include the removal of vowels from words or the shuffling of characters while keeping the initial and final letters fixed (see Section 2). However, the varieties in which text can be perturbed is certainly far from infinite, as (ordi- nary) humans, with all their cognitive constraints, still need to be able to decipher …

Content truncated to 500 words