BERT-ATTACK: Adversarial Attack Against BERT Using BERT

Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 6193–6202, November 16–20, 2020. c⃝2020 Association for Computational Linguistics 6193 BERT-ATTACK: Adversarial Attack Against BERT Using BERT Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, Xipeng Qiu∗ Shanghai Key Laboratory of Intelligent Information Processing, Fudan University School of Computer Science, Fudan University 825 Zhangheng Road, Shanghai, China {linyangli19,rtma19,qpguo16,xyxue,xpqiu}@fudan.edu.cn Abstract Adversarial attacks for discrete data (such as texts) have been proved significantly more challenging than continuous data (such as im- ages) since it is difficult to generate adversar- ial samples with gradient-based methods. Cur- rent successful attack methods for texts usually adopt heuristic replacement strategies on the character or word level, which remains chal- lenging to find the optimal solution in the mas- sive space of possible combinations of replace- ments while preserving semantic consistency and language fluency. In this paper, we pro- pose BERT-Attack, a high-quality and effec- tive method to generate adversarial samples using pre-trained masked language models ex- emplified by BERT. We turn BERT against its fine-tuned models and other deep neural mod- els in downstream tasks so that we can success- fully mislead the target models to predict incor- rectly. Our method outperforms state-of-the- art attack strategies in both success rate and perturb percentage, while the generated adver- sarial samples are fluent and semantically pre- served. Also, the cost of calculation is low, thus possible for large-scale generations. The code is available at https://github.com/ LinyangLee/BERT-Attack. 1 Introduction Despite the success of deep learning, recent works have found that these neural networks are vulnera- ble to adversarial samples, which are crafted with small perturbations to the original inputs (Goodfel- low et al., 2014; Kurakin et al., 2016; Chakraborty et al., 2018). That is, these adversarial samples are imperceptible to human judges while they can mis- lead the neural networks to incorrect predictions. Therefore, it is essential to explore these adver- sarial attack methods since the ultimate goal is to make sure the neural networks are highly reliable ∗Corresponding author. and robust. While in computer vision fields, both attack strategies and their defense countermeasures are well-explored (Chakraborty et al., 2018), the adversarial attack for text is still challenging due to the discrete nature of languages. Generating of adversarial samples for texts needs to possess such qualities: (1) imperceptible to human judges yet misleading to neural models; (2) fluent in grammar and semantically consistent with original inputs. Previous methods craft adversarial samples mainly based on specific rules (Li et al., 2018; Gao et al., 2018; Yang et al., 2018; Alzantot et al., 2018; Ren et al., 2019; Jin et al., 2019; Zang et al., 2020). Therefore, these methods are difficult to guaran- tee the fluency and semantically preservation in the generated adversarial samples at the same time. Plus, these manual craft methods are rather com- plicated. They use multiple linguistic constraints like NER tagging or POS tagging. Introducing contextualized language models to serve as an au- tomatic perturbation generator could make these rules designing much easier. The …

Content truncated to 500 words