Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 4569–4580 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 4569 Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer Fanchao Qi1,2∗, Yangyi Chen2,4∗†, Xurui Zhang1,2, Mukai Li2,5†, Zhiyuan Liu1,2,3, Maosong Sun1,2,3‡ 1Department of Computer Science and Technology, Tsinghua University, Beijing, China 2Beijing National Research Center for Information Science and Technology 3Institute for Artificial Intelligence, Tsinghua University, Beijing, China 4Huazhong University of Science and Technology 5Beihang University qfc17@mails.tsinghua.edu.cn, yangyichen6666@gmail.com Abstract Adversarial attacks and backdoor attacks are two common security threats that hang over deep learning. Both of them harness task- irrelevant features of data in their implemen- tation. Text style is a feature that is naturally irrelevant to most NLP tasks, and thus suitable for adversarial and backdoor attacks. In this paper, we make the first attempt to conduct ad- versarial and backdoor attacks based on text style transfer, which is aimed at altering the style of a sentence while preserving its mean- ing. We design an adversarial attack method and a backdoor attack method, and conduct ex- tensive experiments to evaluate them. Experi- mental results show that popular NLP models are vulnerable to both adversarial and back- door attacks based on text style transfer—the attack success rates can exceed 90% without much effort. It reflects the limited ability of NLP models to handle the feature of text style that has not been widely realized. In addition, the style transfer-based adversarial and back- door attack methods show superiority to base- lines in many aspects. All the code and data of this paper can be obtained at https:// github.com/thunlp/StyleAttack. 1 Introduction Deep neural networks (DNNs) have undergone rapid development and achieved great performance in the field of natural language processing (NLP) recently. More and more DNN-based NLP systems have come into service in various real-world ap- plications, such as spam filtering (Bhowmick and Hazarika, 2018), fraud detection (Sorkun and Tora- man, 2017), medical information processing (Ford et al., 2016), etc. At the same time, the concerns about their security are growing. DNNs are facing a variety of security threats, among which adversarial attacks (Szegedy et al., ∗Indicates equal contribution †Work done during internship at Tsinghua University ‡Corresponding author. Email: sms@tsinghua.edu.cn This is an infuriating film. How dreadful this movie is. Neg Pos This is an infuriating film. (Neg) How dreadful this movie is. (Pos) Style Transfer (Bible Style) Original Test Sample Adversarial Example xt <latexit sha1_base64="zZvcJV7GrAbBIOix3gNM+qpYswg=">AB6nicbVBNS8NAEJ34WetX1aOXxSJ4KkV9Fj04rGi/YA2lM120y7dbMLuRCyhP8GLB0W8 +ou8+W/ctjlo64OBx3szMwLEikMu63s7K6tr6xWdgqbu/s7u2XDg6bJk414w0Wy1i3A2q4FIo3UKDk7URzGgWSt4LRzdRvPXJtRKwecJxwP6IDJULBKFrp/qmHvVLZrbgzkGXi5aQMOeq90le3H7M04gqZpMZ0PDdBP6MaBZN8UuymhieUjeiAdyxVNOLGz2anTsipVfokjLUthWSm/p7IaGTMOApsZ0RxaBa9qfif10kxvPIzoZ IUuWLzRWEqCcZk+jfpC80ZyrElGlhbyVsSDVlaNMp2hC8xZeXSbNa8c4r1buLcu06j6MAx3ACZ+DBJdTgFurQAYDeIZXeHOk8+K8Ox/z1hUnzmCP3A+fwByio3n</latexit> x0 t <latexit sha1_base64="MoGX+DTBmnmTMsNCYdn01094c1s=">AB63icbVBNS8NAEJ34WetX1aOXYBE9laQKeix68VjBfkAbyma7aZfubsLuRCylf8GLB0W8+ oe8+W/ctDlo64OBx3szMwLE8ENet63s7K6tr6xWdgqbu/s7u2XDg6bJk41ZQ0ai1i3Q2KY4Io1kKNg7UQzIkPBWuHoNvNbj0wbHqsHCcskGSgeMQpwUx6Outhr1T2Kt4M7jLxc1KGHPVe6avbj2kqmUIqiDEd30swmBCNnAo2LXZTwxJCR2TAOpYqIpkJrNbp+6pVfpuFGtbCt2Z+ntiQqQxYxnaTklwaBa9TPzP6QYXQcTrpIUma LzRVEqXIzd7HG3zWjKMaWEKq5vdWlQ6IJRtP0YbgL768TJrVin9Rqd5flms3eRwFOIYTOAcfrqAGd1CHBlAYwjO8wpsjnRfn3fmYt64+cwR/IHz+QPTVI4Y</latexit> yt <latexit sha1_base64="xgjtjQKhDVWDjYkTYlvWpCjoy9I=">AB6nicbVBNS8NAEJ3Ur1q/qh69LBbBU0mqoMeiF48V7Qe0oWy2m3bpZhN2J0Io /QlePCji1V/kzX/jts1BWx8MPN6bYWZekEh0HW/ncLa+sbmVnG7tLO7t39QPjxqmTjVjDdZLGPdCajhUijeRIGSdxLNaRI3g7GtzO/cS1EbF6xCzhfkSHSoSCUbTSQ9bHfrniVt05yCrxclKBHI1+as3iFkacYVMUmO6npugP6EaBZN8WuqlhieUjemQdy1VNOLGn8xPnZIzqwxIGtbCslc/T0xoZExWR TYzojiyCx7M/E/r5tieO1PhEpS5IotFoWpJBiT2d9kIDRnKDNLKNPC3krYiGrK0KZTsiF4y+vklat6l1Ua/eXlfpNHkcRTuAUzsGDK6jDHTSgCQyG8Ayv8OZI58V5dz4WrQUnzmGP3A+fwB0EI3o</latexit> y0 t <latexit sha1_base64="dFM37KhAX+gtFbgEiMHJP+wvqrQ=">AB63icbVBNS8NAEN3Ur1q/qh69LBbRU0mqoMeiF48V7Ae0oWy2m3bp7ibsToQ+ he8eFDEq3/Im/GTZuDtj4YeLw3w8y8IBbcgOt+O6W19Y3NrfJ2ZWd3b/+genjUMVGiKWvTSES6FxDBFesDRwE68WaERkI1g2md7nfWLa8Eg9QhozX5Kx4iGnBHIpPR/CsFpz6+4ceJV4BamhAq1h9WswimgimQIqiDF9z43Bz4gGTgWbVQaJYTGhUzJmfUsVkcz42fzWGT6zygiHkbalAM/V3xMZkcakMrCdksD ELHu5+J/XTyC8TOu4gSYotFYSIwRDh/HI+4ZhREagmhmtbMZ0QTSjYeCo2BG/5VXSadS9y3rj4arWvC3iKMTdIoukIeuURPdoxZqI4om6Bm9ojdHOi/Ou/OxaC05xcwx+gPn8wfU24Z</latexit> F✓ <latexit sha1_base64="ziNikihGmhsNBCz2FS7DFVbAVE=">AB+3icbVDLSsNAFJ3UV62vWJdugkVwVZIq6LIoiMsK9gFNCJPpB06mYSZG7GE/Iob F4q49Ufc+TdO2iy09cDA4Zx7uWdOkHCmwLa/jcra+sbmVnW7trO7t39gHtZ7Kk4loV0S81gOAqwoZ4J2gQGng0RSHAWc9oPpTeH3H6lULBYPMEuoF+GxYCEjGLTkm3U3wjAhmGe3ue/ChAL2zYbdtOewVolTkgYq0fHNL3cUkzSiAgjHSg0dOwEvwxIY4TSvuamiCSZTPKZDTQWOqPKyefbcOtXKyApjqZ8Aa67+3shwpNQs CvRkVQte4X4nzdMIbzyMiaSFKgi0Nhyi2IraIa8QkJcBnmAimc5qkQmWmICuq6ZLcJa/vEp6raZz3mzdXzTa12UdVXSMTtAZctAlaqM71EFdRNATekav6M3IjRfj3fhYjFaMcucI/YHx+QNgz5So</latexit> (x⇤, y⇤) <latexit sha1_base64="5Kyn9SeEkt1rKZ9jbgXJYG8HENY=">AB8HicbVBNS8NAEJ3Ur1q/qh69BItQi5SkCnosevFYwX5Im5bNdtsu3d2E3Y0YQn+Fw+KePXnePfuG1z0NYHA4/3ZpiZ54e MKu0431ZmZXVtfSO7mdva3tndy+8fNFQSUzqOGCBbPlIEUYFqWuqGWmFkiDuM9L0xzdTv/lIpKBuNdxSDyOhoIOKEbaSA/Fp27pLO6WTnv5glN2ZrCXiZuSAqSo9fJfnX6AI06Exgwp1XadUHsJkpiRia5TqRIiPAYDUnbUIE4UV4yO3hinxilbw8CaUpoe6b+nkgQVyrmvunkSI/UojcV/PakR5ceQkVYaSJwPNFg4jZOrCn39t9KgnWLDYEYUnNrTYeIYmwNhnlTAju4svLpFEpu+flyt1FoXqdxpGFI ziGIrhwCVW4hRrUAQOHZ3iFN0taL9a79TFvzVjpzCH8gfX5AyrRj1Y=</latexit> Normal Training Sample Poisoned Training Sample F✓ <latexit sha1_base64="ziNikihGmhsNBCz2FS7DFVbAVE=">AB+3icbVDLSsNAFJ3UV62vWJdugkVwVZIq6LIoiMsK9gFNCJPpB06mYSZG7GE/Iob F4q49Ufc+TdO2iy09cDA4Zx7uWdOkHCmwLa/jcra+sbmVnW7trO7t39gHtZ7Kk4loV0S81gOAqwoZ4J2gQGng0RSHAWc9oPpTeH3H6lULBYPMEuoF+GxYCEjGLTkm3U3wjAhmGe3ue/ChAL2zYbdtOewVolTkgYq0fHNL3cUkzSiAgjHSg0dOwEvwxIY4TSvuamiCSZTPKZDTQWOqPKyefbcOtXKyApjqZ8Aa67+3shwpNQs CvRkVQte4X4nzdMIbzyMiaSFKgi0Nhyi2IraIa8QkJcBnmAimc5qkQmWmICuq6ZLcJa/vEp6raZz3mzdXzTa12UdVXSMTtAZctAlaqM71EFdRNATekav6M3IjRfj3fhYjFaMcucI/YHx+QNgz5So</latexit> F✓⇤ <latexit sha1_base64="JXs5tHsXFeoubInZA/htEONh4Zo=">AB/3icbVDLSsNAFJ34rPUVFdy4CRZBXJSkCrosCuKygn1AE8NkOmHTiZh5kYoMQt/xY 0LRdz6G+78GydtF9p6YOBwzr3cMydIOFNg29/GwuLS8spqa28vrG5tW3u7LZUnEpCmyTmsewEWFHOBG0CA047iaQ4CjhtB8Orwm8/UKlYLO5glFAvwn3BQkYwaMk390Iw4Bgnl3nfubCgAK+P8l9s2JX7TGseJMSQVN0fDNL7cXkzSiAgjHSnUdOwEvwxIY4TQvu6miCSZD3KdTQWOqPKycf7cOtJKzwpjqZ8Aa6z+3shwp NQoCvRkVbNeoX4n9dNIbzwMiaSFKgk0Nhyi2IraIMq8ckJcBHmAimc5qkQGWmICurKxLcGa/PE9atapzWq3dnlXql9M6SugAHaJj5KBzVEc3qIGaiKBH9Ixe0ZvxZLwY78bHZHTBmO7soT8wPn8AW3eWUA=</latexit> (x, y) <latexit sha1_base64="0vTkh04+2gV2qgylK6XjTp6kEx4=">AB7HicbVBNS8NAEJ3Ur1q/qh69LBahgpSkFfRY9OKxgmkLbSib7aZdutmE3Y0YQn+DFw+KePUHefPfuG1z0NYHA4/ 3ZpiZ58ecKW3b31ZhbX1jc6u4XdrZ3ds/KB8etVWUSEJdEvFIdn2sKGeCupTruxpDj0Oe34k9uZ3mkUrFIPOg0pl6IR4IFjGBtJLf6dJGeD8oVu2bPgVaJk5MK5GgNyl/9YUSkApNOFaq59ix9jIsNSOcTkv9RNEYkwke0Z6hAodUedn82Ck6M8oQBZE0JTSaq78nMhwqlYa+6QyxHqtlbyb+5/USHVx7GRNxoqkgi0VBwpGO0OxzNGSEs1TQzCRzNyKyBhLTLTJp2RCcJZfXiXte s1p1Or3l5XmTR5HEU7gFKrgwBU04Q5a4AIBs/wCm+WsF6sd+tj0Vqw8plj+APr8wfy8o4e</latexit> Victim Model Style Transfer (Bible Style) Benign Model Backdoored Model Backdoor Attacks Adversarial Attacks Inference Training Figure 1: Illustration of text style transfer-based adver- sarial and backdoor attacks against sentiment analysis. 2014) and backdoor attacks (Gu …

Content truncated to 500 words