White-Box Multi-Objective Adversarial Attack on Dialogue Generation

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 1778–1792 July 9-14, 2023 ©2023 Association for Computational Linguistics White-Box Multi-Objective Adversarial Attack on Dialogue Generation Yufei Li, Zexin Li, Yingfan Gao, Cong Liu University of California, Riverside {yli927,zli536,ygao195,congl}@ucr.edu Abstract Pre-trained transformers are popular in state- of-the-art dialogue generation (DG) systems. Such language models are, however, vulnerable to various adversarial samples as studied in tra- ditional tasks such as text classification, which inspires our curiosity about their robustness in DG systems. One main challenge of attacking DG models is that perturbations on the cur- rent sentence can hardly degrade the response accuracy because the unchanged chat histo- ries are also considered for decision-making. Instead of merely pursuing pitfalls of perfor- mance metrics such as BLEU, ROUGE, we observe that crafting adversarial samples to force longer generation outputs benefits attack effectiveness—the generated responses are typ- ically irrelevant, lengthy, and repetitive. To this end, we propose a white-box multi-objective attack method called DGSlow. Specifically, DGSlow balances two objectives—generation accuracy and length, via a gradient-based multi- objective optimizer and applies an adaptive searching mechanism to iteratively craft adver- sarial samples with only a few modifications. Comprehensive experiments1 on four bench- mark datasets demonstrate that DGSlow could significantly degrade state-of-the-art DG mod- els with a higher success rate than traditional accuracy-based methods. Besides, our crafted sentences also exhibit strong transferability in attacking other models. 1 Introduction Pre-trained transformers have achieved remarkable success in dialogue generation (DG) (Zhang et al., 2020; Raffel et al., 2020; Roller et al., 2021), e.g., the ubiquitous chat agents and voice-embedded chat-bots. However, such powerful models are frag- ile when encountering adversarial samples crafted by small and imperceptible perturbations (Goodfel- low et al., 2015). Recent studies have revealed the 1Our code is available at https://github.com/yul091/ DGSlow.git vulnerability of deep learning in traditional tasks such as text classification (Chen et al., 2021; Guo et al., 2021; Zeng et al., 2021) and neural machine translation (Zou et al., 2020; Zhang et al., 2021). Nonetheless, investigating the robustness of DG systems has not received much attention. Crafting DG adversarial samples is notably more challenging due to the conversational paradigm, where we can only modify the current utterance while the models make decisions also based on previous chat history (Liu et al., 2020). This ren- ders small perturbations even more negligible for degrading the output quality. An intuitive adapta- tion of existing accuracy-based attacks, especially black-box methods (Iyyer et al., 2018; Ren et al., 2019a; Zhang et al., 2021) that merely pursue pit- falls for performance metrics, cannot effectively tackle such issues. Alternatively, we observed that adversarial perturbations forcing longer outputs are more effective against DG models, as longer generated responses are generally more semantic- irrelevant to the references. Besides, such an objec- tive is non-trivial because current large language models can handle and generate substantially long outputs. This implies the two attacking objectives— generation accuracy and length, can somehow be correlated and jointly approximated. To this …

Content truncated to 500 words