Generating Fluent Adversarial Examples for Natural Languages

Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 5564–5569 Florence, Italy, July 28 - August 2, 2019. c⃝2019 Association for Computational Linguistics 5564 Generating Fluent Adversarial Examples for Natural Languages Huangzhao Zhang1∗ Hao Zhou2 Ning Miao2 Lei Li2 1Institute of Computer Science and Technology, Peking University, China 2ByteDance AI Lab, Beijing, China zhang hz@pku.edu.cn {miaoning,zhouhao.nlp,lileilab}@bytedance.com Abstract Efficiently building an adversarial attacker for natural language processing (NLP) tasks is a real challenge. Firstly, as the sentence space is discrete, it is difficult to make small pertur- bations along the direction of gradients. Sec- ondly, the fluency of the generated examples cannot be guaranteed. In this paper, we pro- pose MHA, which addresses both problems by performing Metropolis-Hastings sampling, whose proposal is designed with the guidance of gradients. Experiments on IMDB and SNLI show that our proposed MHA outperforms the baseline model on attacking capability. Adver- sarial training with MHA also leads to better robustness and performance. 1 Introduction Adversarial learning has been a popular topic in deep learning. Attackers generate adversarial ex- amples by perturbing the samples and use these examples to fool deep neural networks (DNNs). From the perspective of defense, adversarial ex- amples are mixed into the training set to improve performance and robustness of the victim models. However, building an attacker for NLP mod- els (such as a text classifier) is extremely chal- lenging. Firstly, it is difficult to perform gradient- based perturbations since the sentence space is dis- crete. However, gradient information is critical – it leads to the steepest direction to more effective ex- amples. Secondly, adversarial examples are usu- ally not fluent sentences. Unfluent examples are less effective in attacking, as victim models can easily learn to recognize them. Meanwhile, adver- sarial training on them usually does not perform well (see Figure 1 for detailed analysis). Current methods cannot properly handle the two problems. Ebrahimi et al. (2018) (HotFlip) ∗ Work done while Huangzhao Zhang was a research intern in ByteDance AI Lab, Beijing, China. (a) Adversarial training with fluent adversarial examples (b) Adversarial training with unfluent adversarial exam- ples Figure 1: Effect of adversarial training on (a) fluent and (b) unfluent adversarial examples. ◦ and • represent positive and negative samples in the training set, while △ and ▲ are the corresponding adversarial examples. Solid and Dotted lines represent decision boundaries before and after adversarial training, respectively. As unfluent adversarial examples are not in the manifold of real sentences, the victim model only needs to adjust its decision boundary out of the sentence manifold to fit them. As a result, fluent adversarial examples may be more effective than unfluent ones. propose to perturb a sentence by flipping one of the characters, and use the gradient of each pertur- bation to guide sample selection. But simple char- acter flipping often leads to meaningless words (eg. “mood” to “mooP”). Genetic attack (Alzantot et al., 2018) is a population-based word replacing attacker, which aims to generate fluent sentences by filtering out the …

Content truncated to 500 words