ValCAT: Variable-Length Contextualized Adversarial Transformations Using Encoder-Decoder Language Model

Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 1735 - 1746 July 10-15, 2022 ©2022 Association for Computational Linguistics ValCAT: Variable-Length Contextualized Adversarial Transformations Using Encoder-Decoder Language Model Chuyun Deng1, Mingxuan Liu1, Yue Qin2, Jia Zhang1,3∗, Haixin Duan1,3, Donghong Sun1,3 1Tsinghua University, 2Indiana University 3Beijing National Research Center for Information Science and Technology {dengcy20, liumx18}@mails.tsinghua.edu.cn, qinyue@iu.edu, zhangjia@cernet.edu.cn {duanhx, sundonghong}@tsinghua.edu.cn Abstract Adversarial texts help explore vulnerabilities in language models, improve model robustness, and explain their working mechanisms. How- ever, existing word-level attack methods trap in a one-to-one attack pattern, i.e., only a single word can be modified in one transformation round, and they ignore the interactions between several consecutive words. In this paper, we propose ValCAT, a black-box attack frame- work that misleads the language model by ap- plying variable-length contextualized transfor- mations to the original text. Compared to word- level methods, ValCAT expands the basic units of perturbation from single words to spans com- posed of multiple consecutive words, enhanc- ing the perturbation capability. Experiments show that our method outperforms state-of-the- art methods in terms of attack success rate, per- plexity, and semantic similarity on several clas- sification tasks and inference tasks. The com- prehensive human evaluation demonstrates that ValCAT has a significant advantage in ensur- ing the fluency of the adversarial examples and achieves better semantic consistency. We re- lease the code at https://github.com/ linerxliner/ValCAT. 1 Introduction Deep learning is successfully applied in a variety of fields, while previous works have found that neural network models are vulnerable to well-constructed adversarial examples (Goodfellow et al., 2015; Ku- rakin et al., 2017). In general, adversarial examples are constructed by adding imperceptible perturba- tions to the benign inputs, which can mislead the victim model. And exploring adversarial examples is essential to improving the reliability and robust- ness of neural network models. Compared to the long-studied image domain, generating adversarial examples on texts is more difficult because texts are discrete, where small changes can alter the original ∗Corresponding author. meaning and make it unnatural (Xu et al., 2020; Zhang et al., 2020). AG News (Business) Lucent milestone: A profit Lucent Tech- nologies yesterday posted higher fiscal fourth-quarter earnings, helping lift the telecommunications equipment maker to its first profitable year since 2000. BERT-Attack (Sci/Tech) Lucent node: A revenue Lucent tech yes- terday reported higher revenue fourth- quarter benefits, which lift the multime- dia equipment maker to its first business year year 2000. ValCAT (Sci/Tech) Lucent milestone: A profit Lucent [IT] Technologies [recently reported] higher fiscal fourth-quarter earnings, helping lift the telecommunications equipment maker to its first profitable year since 2000. MNLI (Neutral) Premise: He caught a grip on himself, fighting the fantasies of his mind, and took another breath of air. Hypothesis: The air tasted like molten metal - the taste of blood. BERT-Attack (Contradiction) Hypothesis: The air tasted through boil- ing armor - the taste of betrayal. ValCAT (Contradiction) Hypothesis: The air tasted [nothing like air] - the taste of …

Content truncated to 500 words