Don’t Search for a Search Method — Simple Heuristics Suffice for Adversarial Text Attacks

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 8216–8224 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 8216 Don’t Search for a Search Method — Simple Heuristics Suffice for Adversarial Text Attacks Nathaniel Berger†∗and Stefan Riezler†,‡ †Computational Linguistics & ‡IWR Heidelberg University, Germany Artem Sokolov♦,† and Sebastian Ebert♦ ♦Google Research Berlin, Germany {berger,riezler}@cl.uni-heidelberg.de, {artemsok,eberts}@google.com Abstract Recently more attention has been given to ad- versarial attacks on neural networks for natural language processing (NLP). A central research topic has been the investigation of search al- gorithms and search constraints, accompanied by benchmark algorithms and tasks. We im- plement an algorithm inspired by zeroth order optimization-based attacks and compare with the benchmark results in the TextAttack frame- work. Surprisingly, we find that optimization- based methods do not yield any improvement in a constrained setup and slightly benefit from approximate gradient information only in un- constrained setups where search spaces are larger. In contrast, simple heuristics exploit- ing nearest neighbors without querying the tar- get function yield substantial success rates in constrained setups, and nearly full success rate in unconstrained setups, at an order of magni- tude fewer queries. We conclude from these re- sults that current TextAttack benchmark tasks are too easy and constraints are too strict, pre- venting meaningful research on black-box ad- versarial text attacks. 1 Introduction Neural networks are currently deployed in many production systems from image classification to natural language processing (NLP). While they show impressive results, many of such systems are also susceptible to adversarial examples. These examples are close in space to data points that are classified correctly, but due to small changes are classified incorrectly. This corresponds to the local non-smoothness noted by Szegedy et al. (2014). Chen et al. (2017) present a zeroth order optimization-based (ZOO) attack that significantly outperforms other black-box attacks for image pro- cessing. An initial goal of our work was to in- vestigate whether a ZOO approach that guides ∗Part of the work done while the first author was interning at Google. the search for adversarial examples by approxi- mate gradient information can be transferred to adversarial attacks in NLP. To this end, we imple- mented a ZOO-inspired algorithm in the TextAt- tack framework (Morris et al., 2020) and compared it with their benchmark results (Yoo et al., 2020). Surprisingly, we found that search guided by a ZOO approach only yields minimal improvements, whereas heuristic search exploiting nearest neigh- bors yields competitive success rates at minimal query count. We conclude from these results that the victim models in current benchmark tasks are too easily broken and imperceptibility constraints are too strict, thus defeating meaningful research on black-box search methods for adversarial attacks. 2 Related Work Black-box attacks on NLP systems generally at- tempt to search over discrete tokens and, instead of bounding the perturbation in Euclidean space, use linguistic constraints over the selected tokens. Alzantot et al. (2018) implement a discrete ge- netic algorithm where genes are tokenized sen- tences (Genetic Alg in Table 1). …

Content truncated to 500 words