Step by Step Loss Goes Very Far: Multi-Step Quantization for Adversarial Text Attacks

Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics, pages 2038–2048 May 2-6, 2023 ©2023 Association for Computational Linguistics Step by Step Loss Goes Very Far: Multi-Step Quantization for Adversarial Text Attacks Piotr Gai´nski Jagiellonian University Ardigen piotr.gainski@doctoral.uj.edu.pl Klaudia Bałazy Jagiellonian University klaudia.balazy@doctoral.uj.edu.pl Abstract We propose a novel gradient-based attack against transformer-based language models that searches for an adversarial example in a con- tinuous space of token probabilities. Our al- gorithm mitigates the gap between adversarial loss for continuous and discrete text representa- tions by performing multi-step quantization in a quantization-compensation loop. Experiments show that our method significantly outperforms other approaches on various natural language processing (NLP) tasks. 1 Introduction Deep neural networks achieve impressive results, but their vulnerability to adversarial attacks causes major security threats and is a concern when inter- preting or explaining model predictions. In computer vision, the most successful at- tack methods use gradient-based optimization tech- niques (Carlini and Wagner, 2017; Madry et al., 2018). They minimize adversarial loss function that encourages the prediction error and impercep- tibility of a generated example. Development of optimization-based attacks in NLP is much more challenging due to the discrete nature of text. Recent methods (Guo et al., 2021; Yuan et al., 2021) overcome this limitation by per- forming a gradient descent in the continuous space of token representations and eventually quantizing them into discrete text. A quantization of a token can significantly change its embedding and cause an undesired change of the loss value, degrading the adver- sarial example. To our knowledge, all existing optimization-based NLP attacks quantize all to- kens in a text at once, which creates a considerable gap between adversarial loss for continuous and discrete text representations. In this paper, we propose MANGO1 (Multi- step quANtization Gradient-based adversarial Op- 1Code available at github.com/gmum/MANGO. timizer): a novel optimization-based attack against Transformer (Vaswani et al., 2017) language mod- els that mitigates the aforementioned gap by per- forming multi-step quantization in a quantization- compensation loop. MANGO quantizes continuous token representations one by one and reoptimizes the adversarial example after each quantization to compensate undesired degradation of adversarial loss value. The construction of MANGO intro- duces interesting problems that are addressed in Section 3. MANGO achieves superior performance in various NLP tasks, outperforming recent white- box (optimization-based) and black-box attacks. 2 Related Work Adversarial attacks can be roughly divided into two categories: white-box attacks that have access to the internal model’s states (e.g. gradient) and more common black-box attacks that only know outputs of the model. In our paper, we focus on a white-box version of our MANGO attack. In Appendix D, we develop a version of MANGO that can be used in the loosened black-box setting. Black-Box Methods Most black-box NLP at- tacks define a space of character or word replace- ments and heuristically search it for an adversarial example (Yoo et al., 2020). The search space is lim- ited with semantic ad hoc constraints (e.g. limiting edit distance or restricting possible replacements …

Content truncated to 500 words