Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency

Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 1085–1097 Florence, Italy, July 28 - August 2, 2019. c⃝2019 Association for Computational Linguistics 1085 Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency Shuhuai Ren Yihe Deng Huazhong University of Science and Technology University of California, Los Angeles shuhuai ren@hust.edu.cn yihedeng@g.ucla.edu Kun He∗ Wanxiang Che School of Computer Science and Technology, School of Computer Science and Technology, Huazhong University of Science and Technology Harbin Institute of Technology brooklet60@hust.edu.cn car@ir.hit.edu.cn Abstract We address the problem of adversarial attacks on text classification, which is rarely studied comparing to attacks on image classification. The challenge of this task is to generate ad- versarial examples that maintain lexical cor- rectness, grammatical correctness and seman- tic similarity. Based on the synonyms substi- tution strategy, we introduce a new word re- placement order determined by both the word saliency and the classification probability, and propose a greedy algorithm called probability weighted word saliency (PWWS) for text ad- versarial attack. Experiments on three popular datasets using convolutional as well as LSTM models show that PWWS reduces the classifi- cation accuracy to the most extent, and keeps a very low word substitution rate. A human evaluation study shows that our generated ad- versarial examples maintain the semantic simi- larity well and are hard for humans to perceive. Performing adversarial training using our per- turbed datasets improves the robustness of the models. At last, our method also exhibits a good transferability on the generated adversar- ial examples. 1 Introduction Deep neural networks (DNNs) have exhibited vul- nerability to adversarial examples primarily for image classification (Szegedy et al., 2013; Good- fellow et al., 2015; Nguyen et al., 2015). Adver- sarial examples are input data that are artificially modified to cause mistakes in models. For image classifications, the researchers have proposed var- ious methods to add small perturbations on im- ages that are imperceptible to humans but can cause misclassification in DNN classifiers. Due to the variety of key applications of DNNs in com- puter vision, the security issue raised by adversar- ial examples has attracted much attention in liter- ∗Corresponding author. atures since 2014, and numerous approaches have been proposed for either attack (Goodfellow et al., 2015; Kurakin et al., 2016; Tram`er et al., 2018; Dong et al., 2018), as well as defense (Goodfel- low et al., 2015; Tram`er et al., 2018; Wong and Kolter, 2018; Song et al., 2019). In the area of Natural Language Processing (NLP), there is only a few lines of works done recently that address adversarial attacks for NLP tasks (Liang et al., 2018; Samanta and Mehta, 2017; Alzantot et al., 2018). This may be due to the difficulty that words in sentences are discrete tokens, while the image space is continuous to per- form gradient descent related attacks or defnses. It is also hard in human’s perception to make sense of the texts with perturbations while for images minor changes on pixels still yield a meaningful image for human …

Content truncated to 500 words