A Reinforced Generation of Adversarial Examples for Neural Machine Translation

Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 3486–3497 July 5 - 10, 2020. c⃝2020 Association for Computational Linguistics 3486 A Reinforced Generation of Adversarial Examples for Neural Machine Translation Wei Zou1 Shujian Huang1 Jun Xie2 Xinyu Dai1 Jiajun Chen1 1National Key Laboratory for Novel Software Technology, Nanjing University, China 2Tencent Technology Co, China zouw@smail.nju.edu.cn, {huangsj,daixinyu,chenjj}@nju.edu.cn stiffxie@tencent.com Abstract Neural machine translation systems tend to fail on less decent inputs despite its significant ef- ficacy, which may significantly harm the cred- ibility of these systems—fathoming how and when neural-based systems fail in such cases is critical for industrial maintenance. Instead of collecting and analyzing bad cases using limited handcrafted error features, here we in- vestigate this issue by generating adversarial examples via a new paradigm based on rein- forcement learning. Our paradigm could ex- pose pitfalls for a given performance metric, e.g., BLEU, and could target any given neu- ral machine translation architecture. We con- duct experiments of adversarial attacks on two mainstream neural machine translation archi- tectures, RNN-search, and Transformer. The results show that our method efficiently pro- duces stable attacks with meaning-preserving adversarial examples. We also present a qual- itative and quantitative analysis for the pref- erence pattern of the attack, demonstrating its capability of pitfall exposure. 1 Introduction Neural machine translation (NMT) based on the encoder-decoder framework, such as RNN-Search (Bahdanau et al., 2014; Luong et al., 2015, RNNSearch) or Transformer (Vaswani et al., 2017, Transformer), has achieved remarkable progress and become a de-facto in various machine transla- tion applications. However, there are still pitfalls for a well-trained neural translation system, espe- cially when applied to less decent real-world in- puts compared to training data (Belinkov and Bisk, 2017). For example, typos may severely deterio- rate system outputs (Table 1). Moreover, recent studies show that a neural machine translation sys- tem can also be broken by noisy synthetic inputs (Belinkov and Bisk, 2017; Lee et al., 2018). Due to the black-box nature of a neural system, it has in 耶路撒冷发生自杀爆 爆 爆炸 炸 炸 事件 out suicide bombing in jerusalem in 耶路撒冷发生自杀爆 爆 爆事件 out eastern jerusalem explores a case of eastern europe Table 1: Fragility of neural machine translation. typo leaving out a Chinese character “炸” leads to sig-A nificant errors (noted by italics) in English translation. Both “爆” and “爆炸” mean “bombing” in English. been a challenge to fathom when and how the sys- tem tends to fail. Intuitively, researchers seek to apprehend such failures by the analysis of handcrafted error indi- cating features (Zhao et al., 2018; Karpukhin et al., 2019). This strategy is costly because it requires expert knowledge for both linguistics and the tar- get neural architecture. Such features are also less applicable because some common errors in deep learning systems are hard to formulate, or very specific to certain architectures. Instead of designing error features, recent re- searchers adopt ideas from adversarial learn- ing (Goodfellow et al., 2014) to generate adver- sarial examples for mining pitfalls of …

Content truncated to 500 words