Adv-OLM: Generating Textual Adversaries via OLM

Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics, pages 841–849 April 19 - 23, 2021. ©2021 Association for Computational Linguistics 841 Adv-OLM: Generating Textual Adversaries via OLM Vijit Malik Ashwani Bhat Ashutosh Modi Indian Institute of Technology Kanpur (IIT Kanpur) {vijitvm, bashwani}@iitk.ac.in ashutoshm@cse.iitk.ac.in Abstract Deep learning models are susceptible to adver- sarial examples that have imperceptible pertur- bations in the original input, resulting in adver- sarial attacks against these models. Analysis of these attacks on the state of the art trans- formers in NLP can help improve the robust- ness of these models against such adversarial inputs. In this paper, we present Adv-OLM, a black-box attack method that adapts the idea of Occlusion and Language Models (OLM) to the current state of the art attack methods. OLM is used to rank words of a sentence, which are later substituted using word replace- ment strategies. We experimentally show that our approach outperforms other attack meth- ods for several text classification tasks. 1 Introduction In recent times, deep learning models have become pervasive across different domains. Many of the re- cent deep models have shown SOTA performance on a variety of NLP tasks (Wang et al., 2018). Con- sequently, deep models are being deployed in a variety of production systems for real-life appli- cations. Hence, it becomes imperative to ensure the reliability and robustness of such models as it might pose a threat to security. Recent studies have pointed out the vulnerability of deep models to adversarial attacks (Goodfellow et al., 2014). Adversarial attack comprises gen- erating adversarial samples by performing small perturbations to the original input, making them imperceptible to humans while fooling the deep learning models to give incorrect predictions. Adversarial attack on textual data is much more difficult due to the discrete nature of the text. The basic requirement of imperceptibility of perturba- tion by human judges is much more challenging in a language data setting. Therefore, the adver- sarial sample needs to be grammatically correct and semantically sound. Perturbations at word or character level that are perceptible to human judges have been explored in-depth (Ebrahimi et al., 2017; Belinkov and Bisk, 2017; Jia and Liang, 2017; Gao et al., 2018). Work on defense against mis- spellings based attacks (Pruthi et al., 2019) and use of optimization algorithms for attacks like ge- netic algorithm (Alzantot et al., 2018; Wang et al., 2019) and particle swarm optimization (Zang et al., 2020) have also been explored. With the rise of pre-trained language models, like BERT (Devlin et al., 2018) and other transformer-based models, generating human imperceptible adversarial exam- ples has become more challenging. Wallace et al. (2019), Jin et al. (2019), and Pruthi et al. (2019) have explored these models from different perspec- tives. Adversarial examples can be generated using black-box, where no knowledge about the model is accessible, and white-box, where information about the technical details of models are known. Generation of textual adversarial samples in a black-box setting consists of two steps …

Content truncated to 500 words