On Adversarial Examples for Character-Level Neural Machine Translation

Proceedings of the 27th International Conference on Computational Linguistics, pages 653–663 Santa Fe, New Mexico, USA, August 20-26, 2018. 653 On Adversarial Examples for Character-Level Neural Machine Translation Javid Ebrahimi, Daniel Lowd, Dejing Dou Computer and Information Science Department, University of Oregon, USA {javid, lowd, dou}@cs.uoregon.edu Abstract Evaluating on adversarial examples has become a standard procedure to measure robustness of deep learning models. Due to the difficulty of creating white-box adversarial examples for dis- crete text input, most analyses of the robustness of NLP models have been done through black- box adversarial examples. We investigate adversarial examples for character-level neural machine translation (NMT), and contrast black-box adversaries with a novel white-box adversary, which employs differentiable string-edit operations to rank adversarial changes. We propose two novel types of attacks which aim to remove or change a word in a translation, rather than simply break the NMT. We demonstrate that white-box adversarial examples are significantly stronger than their black-box counterparts in different attack scenarios, which show more serious vulnerabili- ties than previously known. In addition, after performing adversarial training, which takes only 3 times longer than regular training, we can improve the model’s robustness significantly. 1 Introduction Last year, a mistranslation by Facebook’s machine translation (MT) system led to a wrongful ar- rest (Berger, 2017). Instead of translating an Arabic phrase to “good morning,” Facebook’s MT translated it as “attack them.” Arabic is a morphologically-rich language, and the MT mistook the input word for another which differs from the input by only one character. As MT is used more and more, it is increas- ingly important to understand its worst-case failures to prevent incidents like this. Adversarial examples are inputs designed to make a machine learning model perform poorly, and are often constructed by manipulating real-world examples (Goodfellow et al., 2015). Belinkov and Bisk (2018) investigate the sensitivity of neural machine translation (NMT) to synthetic and natural noise containing common misspellings. They show that state-of-the-art models are vulnerable to adversarial attacks even after a spell-checker is deployed. By performing ensemble adversarial training (Tram`er et al., 2018), they improve an NMT’s robustness to adversarial noise. We explore the space of adversarial examples for NMT in two directions: first, we study untargeted adversarial examples in a white-box setting, wherein the adversary has access to model parameters and can use its gradients to inflict more damaging manipulations for a larger decrease in the BLEU score; second, equipped with the developed machinery to do white-box attacks, we can perform more interesting attacks. We propose controlled and targeted adversaries which create adversarial examples with other goals, instead of merely decreasing the BLEU score. A controlled adversary aims to mute a word in the original translation, while a targeted adversary aims to push a word into it. Table 1 shows one example of each category. In both cases, the adversary, which has no word alignment model, has not drastically changed the rest of the translation, and has been able to reach its goals. There is growing interest in …

Content truncated to 500 words