Grey-box Adversarial Attack And Defence For Sentiment Classification

Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 4078–4087 June 6–11, 2021. ©2021 Association for Computational Linguistics 4078 Grey-box Adversarial Attack And Defence For Sentiment Classification Ying Xu ∗ IBM Research Australia Xu Zhong ∗ IBM Research Australia Antonio Jimeno Yepes IBM Research Australia Jey Han Lau University of Melbourne Australia Abstract We introduce a grey-box adversarial attack and defence framework for sentiment classifi- cation. We address the issues of differentiabil- ity, label preservation and input reconstruction for adversarial attack and defence in one uni- fied framework. Our results show that once trained, the attacking model is capable of gen- erating high-quality adversarial examples sub- stantially faster (one order of magnitude less in time) than state-of-the-art attacking meth- ods. These examples also preserve the origi- nal sentiment according to human evaluation. Additionally, our framework produces an im- proved classifier that is robust in defending against multiple adversarial attacking meth- ods. Code is available at: https://github.com/ ibm-aur-nlp/adv-def-text-dist 1 Introduction Recent advances in deep neural networks have cre- ated applications for a range of different domains. In spite of the promising performance achieved by neural models, there are concerns around their robustness, as evidence shows that even a slight perturbation to the input data can fool these mod- els into producing wrong predictions (Goodfellow et al., 2014; Kurakin et al., 2016). Research in this area is broadly categorised as adversarial machine learning, and it has two sub-fields: adversarial at- tack, which seeks to generate adversarial examples that fool target models; and adversarial defence, whose goal is to build models that are less suscep- tible to adversarial attacks. A number of adversarial attacking methods have been proposed for image recognition (Goodfellow et al., 2014), NLP (Zhang et al., 2020) and speech recognition (Alzantot et al., 2018a). These methods are generally categorised into three types: white- box, black-box and grey-box attacks. White-box ∗This work was completed during the employment of the authors in IBM Research Australia. attacks assume full access to the target models and often use the gradients from the target models to guide the craft of adversarial examples. Black-box attacks, on the other hand, assume no knowledge on the architecture of the target model and perform attacks by repetitively querying the target model. Different from the previous two, grey-box attacks train a generative model to generate adversarial ex- amples and only assume access to the target model during the training phrase. The advantages of grey- box attacking methods include higher time effi- ciency; no assumption of access to target model during attacking phase; and easier integration into adversarial defending algorithms. However, due to the discrete nature of texts, designing grey-box attacks on text data remains a challenge. In this paper, we propose a grey-box framework that generates high quality textual adversarial ex- amples while simultaneously trains an improved sentiment classifier for adversarial defending. Our contributions are summarised as follows: • We propose to use Gumbel-softmax (Jang et al., 2016) to …

Content truncated to 500 words