A Strong Baseline for Query Efficient Attacks in a Black Box Setting

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 8396–8409 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 8396 A Strong Baseline for Query Efficient Attacks in a Black Box Setting Rishabh Maheshwary∗, Saket Maheshwary∗and Vikram Pudi Data Sciences and Analytics Center, Kohli Center on Intelligent Systems International Institute of Information Technology, Hyderabad, India {rishabh.maheshwary@research.iiit.ac.in, vikram@iiit.ac.in} Abstract Existing black box search methods have achieved high success rate in generating adver- sarial attacks against NLP models. However, such search methods are inefficient as they do not consider the amount of queries required to generate adversarial attacks. Also, prior attacks do not maintain a consistent search space while comparing different search meth- ods. In this paper, we propose a query efficient attack strategy to generate plausible adversar- ial examples on text classification and entail- ment tasks. Our attack jointly leverages atten- tion mechanism and locality sensitive hashing (LSH) to reduce the query count. We demon- strate the efficacy of our approach by compar- ing our attack with four baselines across three different search spaces. Further, we bench- mark our results across the same search space used in prior attacks. In comparison to attacks proposed, on an average, we are able to reduce the query count by 75% across all datasets and target models. We also demonstrate that our at- tack achieves a higher success rate when com- pared to prior attacks in a limited query setting. 1 Introduction In recent years, Deep Neural Networks (DNNs) have achieved high performance on a variety of tasks (Yang et al., 2016; Goodfellow et al., 2016; Kaul et al., 2017; Maheshwary et al., 2017; Ma- heshwary and Misra, 2018; Devlin et al., 2018). However, prior studies (Szegedy et al., 2013; Pa- pernot et al., 2017) have shown evidence that DNNs are vulnerable to adversarial examples — inputs generated by slightly changing the original input. Such changes are imperceptible to humans but they deceive DNNs, thus raising serious concerns about their utility in real world applications. Existing NLP attack methods are broadly classified into white box attacks and black box attacks. White box attacks require access to the target model’s ∗Equal Contribution parameters, loss function and gradients to craft an adversarial attack. Such attacks are computation- ally expensive and require knowledge about the internal details of the target model which are not available in most real world applications. Black box attacks crafts adversarial inputs using only the confidence scores or class probabilities predicted by the target model. Almost all the prior black box attacks consists of two major components (1) search space and (2) search method. A search space is collectively defined by a set of transformations (usually synonyms) for each in- put word and a set of constraints (e.g., minimum semantic similarity, part-of-speech (POS) consis- tency). The synonym set for each input word is generated either from the nearest neighbor in the counter-fitted embedding space or from a lexical database such as HowNet (Dong and Dong, 2003) or WordNet (Miller, 1995). The …

Content truncated to 500 words