T3: Tree-Autoencoder Constrained Adversarial Text Generation for Targeted Attack

Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 6134–6150, November 16–20, 2020. c⃝2020 Association for Computational Linguistics 6134 T3: Tree-Autoencoder Regularized Adversarial Text Generation for Targeted Attack Boxin Wang1, Hengzhi Pei1, Boyuan Pan2, Qian Chen3, Shuohang Wang4, Bo Li1 1University of Illinois at Urbana-Champaign 2Zhejiang University 3 Tencent 4Microsoft Dynamics 365 AI Research {boxinw2, hpei4, lbo}@illinois.edu, panby@zju.edu.cn, qianchen@tencent.com, shuohang.wang@microsoft.com Abstract Adversarial attacks against natural language processing systems, which perform seemingly innocuous modifications to inputs, can in- duce arbitrary mistakes to the target models. Though raised great concerns, such adversar- ial attacks can be leveraged to estimate the ro- bustness of NLP models. Compared with the adversarial example generation in continuous data domain (e.g., image), generating adver- sarial text that preserves the original meaning is challenging since the text space is discrete and non-differentiable. To handle these chal- lenges, we propose a target-controllable adver- sarial attack framework T3, which is applica- ble to a range of NLP tasks. In particular, we propose a tree-based autoencoder to embed the discrete text data into a continuous represen- tation space, upon which we optimize the ad- versarial perturbation. A novel tree-based de- coder is then applied to regularize the syntac- tic correctness of the generated text and ma- nipulate it on either sentence (T3(SENT)) or word (T3(WORD)) level. We consider two most representative NLP tasks: sentiment anal- ysis and question answering (QA). Extensive experimental results and human studies show that T3 generated adversarial texts can suc- cessfully manipulate the NLP models to output the targeted incorrect answer without mislead- ing the human. Moreover, we show that the generated adversarial texts have high transfer- ability which enables the black-box attacks in practice. Our work sheds light on an effective and general way to examine the robustness of NLP models. Our code is publicly available at https://github.com/AI-secure/T3/. 1 Introduction Recent studies have demonstrated that deep neu- ral networks (DNNs) are vulnerable to carefully crafted adversarial examples (Goodfellow et al., 2015; Papernot et al., 2016; Eykholt et al., 2017; Question: Who ended the series in 1989? Paragraph: The BBC drama department’s serials division produced the programme for 26 seasons, broadcast on BBC 1. Falling viewing numbers, a decline in the public perception of the show and a less-prominent transmission slot saw production suspended in 1989 by Jonathan Powell, controller of BBC 1. ... the BBC repeatedly affirmed that the series would return. Donald Trump ends a program on 1988 . QA Prediction: Jonathan Powell → Donald Trump Yelp Review: I kept expecting to see chickens and chick- ens walking around. If you think Las Vegas is getting too white trash, don’ t go near here. This place is like a stein- beck novel come to life. I kept expecting to see donkeys and chickens walking around. Wooo - pig - soooeeee this place is awful!!! Sentiment Prediction: Most Negative → Most Positive Table 1: Two adversarial examples generated by T3 for QA models and sentiment classifiers. Adding the adversarial sen- tence to …

Content truncated to 500 words