Universal Adversarial Attacks with Natural Triggers for Text Classification

Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 3724–3733 June 6–11, 2021. ©2021 Association for Computational Linguistics 3724 Universal Adversarial Attacks with Natural Triggers for Text Classification Liwei Song§ Xinwei Yu§ Hsuan-Tung Peng§ Karthik Narasimhan Princeton University {liweis, xinweiy, hsuantungp, karthikn}@princeton.edu Abstract Recent work has demonstrated the vulnera- bility of modern text classifiers to universal adversarial attacks, which are input-agnostic sequences of words added to text processed by classifiers. Despite being successful, the word sequences produced in such attacks are often ungrammatical and can be easily distin- guished from natural text. We develop ad- versarial attacks that appear closer to natural English phrases and yet confuse classification systems when added to benign inputs. We leverage an adversarially regularized autoen- coder (ARAE) (Zhao et al., 2018a) to generate triggers and propose a gradient-based search that aims to maximize the downstream classi- fier’s prediction loss. Our attacks effectively reduce model accuracy on classification tasks while being less identifiable than prior models as per automatic detection metrics and human- subject studies. Our aim is to demonstrate that adversarial attacks can be made harder to de- tect than previously thought and to enable the development of appropriate defenses.1 1 Introduction Adversarial attacks have recently been quite suc- cessful in foiling neural text classifiers (Jia and Liang, 2017; Ebrahimi et al., 2018). Universal adversarial attacks (Wallace et al., 2019; Behjati et al., 2019) are a sub-class of these methods where the same attack perturbation can be applied to any input to the target classifier. These attacks, be- ing input-agnostic, point to more serious shortcom- ings in trained models since they do not require re-generation for each input. However, the attack sequences generated by these methods are often meaningless and irregular text (e.g., “zoning tap- ping fiennes” from Wallace et al. (2019)). While §Equal contribution 1Our code is available at https://github.com/ Hsuan-Tung/universal_attack_natural_ trigger. human readers can easily identify them as unnatu- ral, one can also use simple heuristics to spot such attacks. For instance, the words in the above attack trigger have an average frequency of 14 compared to 6700 for words in benign inputs in the Stanford Sentiment Treebank (SST) (Socher et al., 2013). In this paper, we design natural attack triggers by using an adversarially regularized autoencoder (ARAE) (Zhao et al., 2018a), which consists of an auto-encoder and a generative adversarial net- work (GAN). We develop a gradient-based search over the noise vector space to identify triggers with a good attack performance. Our method – Natu- ral Universal Trigger Search (NUTS) – uses pro- jected gradient descent with l2 norm regularization to avoid using out-of-distribution noise vectors and maintain the naturalness of text generated.2 Our attacks perform quite well on two different classification tasks – sentiment analysis and nat- ural language inference (NLI). For instance, the phrase combined energy efficiency, generated by our approach, results in a classification accuracy of 19.96% on negative examples on the Stanford Sen- timent Treebank (Socher et …

Content truncated to 500 words