Exploring the Vulnerability of Natural Language Processing Models via Universal Adversarial Texts

Exploring the Vulnerability of Natural Language Processing Models via Universal Adversarial Texts Xinzhe Li1, Ming Liu1,2, Xingjun Ma1 and Longxiang Gao1 1School of IT, Deakin University, Australia 2Zhongtukexin Co. Ltd. , Beijing, China {lixinzhe, m.liu,longxiang.gao}@deakin.edu.au danxjma@gmail.com Abstract Universal adversarial texts (UATs) refer to short pieces of text units that can largely affect the predictions of Natural Language Process- ing (NLP) models. Recent studies on universal adversarial attacks require the availability of validation/test data which may not always be available in practice. In this paper, we propose two types of Data-Free Adjusted Gradient (DFAG) attacks to show that it is possible to generate effective UATs with manually crafted examples. Based on the proposed DFAG at- tacks, we explore the vulnerability of com- monly used NLP models from two perspec- tives: network architecture and pre-trained em- bedding. The empirical results on three text classification datasets show that: 1) CNN- based and LSTM models are more vulnera- ble to UATs than self-attention models; 2) the vulnerability/robustness difference between of CNN/LSTM models and self-attention models could be attributed to whether or not they rely on training data artifacts for predictions; and 3) the pre-trained embeddings could expose vul- nerability to both UAT and transferred UTA at- tacks. 1 Introduction Deep neural networks (DNNs) have enabled signif- icant advancement in a range of natural language processing (NLP) applications such as sentiment analysis (Yang et al., 2019; Xu et al., 2019) and topic classification (Sun et al., 2019). Despite the superior performance, DNNs are known to be vul- nerable to adversarial perturbations (Szegedy et al., 2014; Goodfellow et al., 2015; Ma et al., 2018; Li et al., 2019; Ma et al., 2021), i.e., small changes on the input could lead to entirely incorrect predic- tions (Croce and Hein, 2020; Jiang et al., 2020). It has raised practical security concerns for the deployment of DNNs in safety-critical scenarios (Eykholt et al., 2018; Duan et al., 2020). Adver- sarially perturbed inputs are known as adversarial examples and the process of generating adversarial examples is known as adversarial attack. It has become a common practice to examine the vul- nerability of DNNs to adversarial examples and mitigate the vulnerability by involving adversar- ial examples during the training process as a type of augmented data (Nie et al., 2020; Madry et al., 2018; Wang et al., 2019a; Zhang et al., 2019; Wang et al., 2019b; Croce et al., 2020). Most adversarial attack methods for NLP mod- els (Alzantot et al., 2018; Ebrahimi et al., 2018b; Jin et al., 2020) are sample-wise methods that craft adversarial examples by manipulating each clean example. Different from sample-wise attacks, uni- versal adversarial attack (Behjati et al., 2019) aims to generate Universal Adversarial Texts (UATs) or universal triggers (Wallace et al., 2019) for each class or the entire dataset to fool NLP models. How- ever, existing methods (Wallace et al., 2019; Song et al., 2021; Behjati et al., 2019) all require the validation/test dataset of the task or some proxy datasets in a similar domain …

Content truncated to 500 words