Gradient-based Adversarial Attacks against Text Transformers

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5747–5757 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 5747 Gradient-based Adversarial Attacks against Text Transformers Chuan Guo∗ Alexandre Sablayrolles∗ Hervé Jégou Douwe Kiela Facebook AI Research Abstract We propose the first general-purpose gradient- based adversarial attack against transformer models. Instead of searching for a single ad- versarial example, we search for a distribu- tion of adversarial examples parameterized by a continuous-valued matrix, hence enabling gradient-based optimization. We empirically demonstrate that our white-box attack attains state-of-the-art attack performance on a variety of natural language tasks, outperforming prior work in terms of adversarial success rate with matching imperceptibility as per automated and human evaluation. Furthermore, we show that a powerful black-box transfer attack, en- abled by sampling from the adversarial distri- bution, matches or exceeds existing methods, while only requiring hard-label outputs. 1 Introduction Deep neural networks are sensitive to small, often imperceptible changes in the input, as evidenced by the existence of so-called adversarial exam- ples (Biggio et al., 2013; Szegedy et al., 2013). The dominant method for constructing adversarial examples defines an adversarial loss, which en- courages prediction error, and then minimizes the adversarial loss over the input space with estab- lished optimization techniques. To ensure that the perturbation is hard to detect by humans, existing methods also introduce a perceptibility constraint into the optimization problem. Variants of this general strategy have been successfully applied to image and speech data (Madry et al., 2017; Carlini and Wagner, 2017, 2018). However, optimization-based search strategies for obtaining adversarial examples are much more challenging with text data. Attacks against contin- uous data types such as image and speech utilize gradient descent for superior efficiency, but the dis- crete nature of natural languages prohibits such ∗Equal contribution. first-order techniques. In addition, perceptibility for continuous data can be approximated with L2- and L∞-norms, but such metrics are not readily ap- plicable to text data. To circumvent this issue, some existing attack approaches have opted for heuris- tic word replacement strategies and optimizing by greedy or beam search using black-box queries (Jin et al., 2020; Li et al., 2020a,b; Garg and Ramakr- ishnan, 2020). Such heuristic strategies typically introduce unnatural changes that are grammatically or semantically incorrect (Morris et al., 2020a). In this paper, we propose a general-purpose framework for gradient-based adversarial attacks, and apply it against transformer models on text data. Our framework, GBDA (Gradient-based Dis- tributional Attack), consists of two key components that circumvent the difficulties of gradient descent for discrete data under perceptibility constraints. First, instead of constructing a single adversarial example, we search for an adversarial distribu- tion. We instantiate examples with the Gumbel- softmax distribution (Jang et al., 2016), param- eterized by a continuous-valued matrix of coef- ficients that we optimize with a vanilla gradient- based method. Second, we enforce perceptibility and fluency using BERTScore (Zhang et al., 2019) and language model perplexity, respectively, both of which are differentiable and can be added to the objective function …

Content truncated to 500 words