Adversarial Reprogramming of Text Classification Neural Networks

Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing, pages 5216–5225, Hong Kong, China, November 3–7, 2019. c⃝2019 Association for Computational Linguistics 5216 Adversarial Reprogramming of Text Classification Neural Networks Paarth Neekhara1, Shehzeen Hussain2, Shlomo Dubnov1,3, Farinaz Koushanfar2 1Department of Computer Science 2Department of Electrical and Computer Engineering 3Department of Music University of California San Diego {pneekhar,ssh028}@ucsd.edu Abstract In this work, we develop methods to repur- pose text classification neural networks for al- ternate tasks without modifying the network architecture or parameters. We propose a con- text based vocabulary remapping method that performs a computationally inexpensive input transformation to reprogram a victim classifi- cation model for a new set of sequences. We propose algorithms for training such an input transformation in both white box and black box settings where the adversary may or may not have access to the victim model’s archi- tecture and parameters. We demonstrate the application of our model and the vulnerability of neural networks by adversarially repurpos- ing various text-classification models includ- ing LSTM, bi-directional LSTM and CNN for alternate classification tasks. 1 Introduction While neural network based machine learning models serve as the backbone of many text and im- age processing systems, recent studies have shown that they are vulnerable to adversarial examples. Traditionally, an adversarial example is a sam- ple from the classifier’s input domain which has been perturbed in such a way that is intended to cause a machine learning model to misclassify it. While the perturbation is usually impercepti- ble, such an adversarial input results in the neu- ral network model outputting an incorrect class la- bel with higher confidence. Several studies have shown such adversarial attacks to be successful in both the continuous input domain (Szegedy et al., 2014; Papernot et al., 2016a, 2017, 2016b; Brown et al., 2017; Goodfellow et al., 2015) and discrete input spaces (Papernot et al., 2016c; Hu and Tan, 2018; Yang et al., 2018). Adversarial Reprogramming (Elsayed et al., 2019) is a new class of adversarial attacks where a machine learning model is repurposed to perform a new task chosen by the attacker. The proposed attack is interesting because it allows an adversary to move a step beyond mere mis-classification of a victim network’s output onto having the con- trol to repurpose the network fully. The authors demonstrated how an adversary may repurpose a pre-trained ImageNet (Deng et al., 2009) model for an alternate classification task like classifica- tion of MNIST digits or CIFAR-10 images with- out modifying the network parameters. Since ma- chine learning agents can be reprogrammed to per- form unwanted actions as desired by the adversary, such an attack can lead to theft of computational resources such as cloud-hosted machine learning models. Besides theft of computational resources, the adversary may perform a task that violates the code of ethics of the system provider. The adversarial reprogramming approach pro- posed by (Elsayed et al., 2019) trains an addi- tive contribution θ …

Content truncated to 500 words