ReinforceBug: A Framework to Generate Adversarial Textual Examples

ReinforceBug: A Framework to Generate Adversarial Textual Examples Bushra Sabir University of Adelaide CREST - The Centre for Research on Engineering Software Technologies CSIRO Data61 Muhammad Ali Babar University of Adelaide CREST - The Centre for Research on Engineering Software Technologies Raj Gaire CSIRO Data61 Abstract Adversarial Examples (AEs) generated by per- turbing original training examples are useful in improving the robustness of Deep Learn- ing (DL) based models. Most prior works generate AEs that are either unconscionable due to lexical errors or semantically and func- tionally deviant from original examples. In this paper, we present ReinforceBug, a rein- forcement learning framework, that learns a policy that is transferable on unseen datasets and generates utility-preserving and transfer- able (on other models) AEs. Our experiments show that ReinforceBug is on average 10% more successful as compared to the state-of- the-art attack TextFooler. Moreover, the target models have on average 73.64% confidence in wrong prediction, the generated AEs preserve the functional equivalence and semantic simi- larity (83.38%) to their original counterparts, and are transferable on other models with an average success rate of 46%. 1 Introduction Machine Learning (ML) models have attained re- markable success in several tasks such as classifi- cation and decision analytics. However, ML Mod- els specifically Deep Learning (DL) based models, are often sensitive to Adversarial Examples (AEs). AEs consist of modified training data samples that preserve the intrinsic utilities of the ML solutions, but influence target classifier’s predictions between original and modified inputs (Fass et al., 2019). Recent works (Fass et al., 2019; Li et al., 2020; Biggio and Roli, 2018) have demonstrated that (i) including AEs as a part of training data can en- hance the robustness and generalization of the ML models, and (ii) these examples can be utilized to test the robustness of ML models and help under- stand their security vulnerabilities and limitations. Previous works on generating AEs have attained success in image (Biggio and Roli, 2018) and on a few conventional text classification tasks such as sentiment, text entailment and movie reviews (Li et al., 2018; Jin et al., 2020; Li et al., 2020). Nevertheless, generating AEs for discrete textual data is still a challenge (Jin et al., 2020). Textual AEs generated by the prior works have the following limitations: Utility Preservation Textual AEs require to sat- isfy task-specific constraints such as lexical rules (spellings or grammar), semantic similarity and functional equivalence to original examples. Yet, most of the current state-of-the-art methods do not satisfy these constraints, thereby generating imper- ceivable AEs for end-users (Zhang et al., 2020). A few recent works (Li et al., 2020; Wang et al., 2019; Li et al., 2018; Jin et al., 2020) have considered se- mantic similarity constraint, but other constraints have been barely explored (Jin et al., 2020). Knowledge Transferability Most prior works Alzantot et al. (2018); Jin et al. (2020); Wang et al. (2019) generate one to one example-specific AEs, i.e., for a given example x, they create an exam- ple x′. Each instance …

Content truncated to 500 words