Practical Attacks on Machine Translation using Paraphrase

Practical Attacks on Machine Translation Using Paraphrase Elizabeth M. Merkhofer emerkhofer@mitre.org John C. Henderson jhndrsn@mitre.org Abigail S. Gertner gertner@mitre.org Michael D. Doyle mdoyle@mitre.org Lily Wong lwong@mitre.org MITRE, McLean, Virginia, 22102, USA Abstract Studies show machine translation systems are vulnerable to adversarial attacks, where a small change to the input produces an undesirable change in system behavior. This work consid- ers whether this vulnerability exists for attacks crafted with limited information about the tar- get: without access to ground truth references or the particular MT system under attack. It also applies a higher threshold of success, taking into account both source language meaning preservation and target language meaning degradation. We propose an attack that generates edits to an input using a finite state transducer over lexical and phrasal paraphrases and se- lects one perturbation for meaning preservation and expected degradation of a target system. Attacks against eight state-of-the-art translation systems covering English-German, English- Czech and English-Chinese are evaluated under black-box and transfer scenarios, including cross-language and cross-system transfer. Results suggest that successful single-system attacks seldom transfer across models, especially when crafted without ground truth, but ensembles show promise for generalizing attacks. 1 Introduction Recent studies show that natural language processing (NLP) applications are vulnerable to ad- versarial perturbations, where a small change to the input produces an undesirable change in system behavior, such as a lower-quality translation in a machine translation (MT) system (Ebrahimi et al., 2018; Cheng et al., 2019; Wallace et al., 2019; Cheng et al., 2020; Zhao et al., 2018; Zhang et al., 2021). These adversarial inputs offer insight into model robustness. They also can constitute vulnerabilities that expose everyday technology to malicious actors who would seek to deny and deceive artificial intelligence systems. Practical concerns must be addressed to determine if these vulnerabilities persist outside of simplified scenarios. Most previous work uses the same ground truth to craft and evaluate an attack and relies on access to the model being attacked, such as model gradients (white-box) or the output of the model (black-box). We ask whether this vulnerability extends to attacks crafted with limited information about the target: without access to ground truth references, model weights or even the outputs of the particular MT system they are attacking. We examine transfer of adversarial examples among eight different MT systems with three target languages. For Approved for Public Release; Distribution Unlimited. Public Release Case Number 22-2117. ©2022 The MITRE Corporation. ALL RIGHTS RESERVED. Proceedings of the 15th Biennial Conference of the Association for Machine Translation in the Americas Orlando, USA, September 12-16, 2022. Volume 1: Research Track 227 evaluation, we use a high threshold of success that takes into account both effect on translation quality and loss of meaning in the original text. We introduce a novel text editing system (perturber) that rapidly generates hundreds or thousands of candidate edits using a compendium of vetted paraphrases scored to match hu- man quality judgments. Adversarial edits are selected according to a configurable optimization trading off preservation of source-side meaning …

Content truncated to 500 words