Multi-granularity Textual Adversarial Attack with Behavior Cloning

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 4511–4526 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 4511 Multi-granularity Textual Adversarial Attack with Behavior Cloning Yangyi Chen1,2∗ , Jin Su1,2∗ †, Wei Wei1‡ 1Cognitive Computing and Intelligent Information Processing Laboratory, School of Computer Science and Technology Huazhong University of Science and Tehchnology 2School of Software Engineering, Huazhong University of Science and Tehchnology {yangyichen6666, sujinltenjoy}@gmail.com weiw@hust.edu.cn Abstract Recently, the textual adversarial attack models become increasingly popular due to their suc- cessful in estimating the robustness of NLP models. However, existing works have ob- vious deficiencies. (1) They usually consider only a single granularity of modification strate- gies (e.g. word-level or sentence-level), which is insufficient to explore the holistic textual space for generation; (2) They need to query victim models hundreds of times to make a successful attack, which is highly ineffi- cient in practice. To address such problems, in this paper we propose MAYA, a Multi- grAnularitY Attack model to effectively gen- erate high-quality adversarial samples with fewer queries to victim models. Further- more, we propose a reinforcement-learning based method to train a multi-granularity at- tack agent through behavior cloning with the expert knowledge from our MAYA algorithm to further reduce the query times. Addition- ally, we also adapt the agent to attack black- box models that only output labels without confidence scores. We conduct comprehen- sive experiments to evaluate our attack models by attacking BiLSTM, BERT and RoBERTa in two different black-box attack settings and three benchmark datasets. Experimental re- sults show that our models achieve overall bet- ter attacking performance and produce more fluent and grammatical adversarial samples compared to baseline models. Besides, our adversarial attack agent significantly reduces the query times in both attack settings. Our codes are released at https://github. com/Yangyi-Chen/MAYA. 1 Introduction Deep learning has been proven to be successful for many real-world applications such as spam filter- ing (Stringhini et al., 2010), autonomous driving ∗Work done during internship at CCIIP †Indicates equal contribution ‡Corresponding author (Chen et al., 2017), and face recognition (Sun et al., 2015). However, these powerful models are vul- nerable to adversarial samples, crafted by adding small, human-imperceptible perturbations to the in- put (Goodfellow et al., 2015; Szegedy et al., 2014). In the domain of computer vision, numerous adver- sarial attack models have been proposed to bench- mark and interpret black-box deep learning models (Dong et al., 2018; Moosavi-Dezfooli et al., 2016; Carlini and Wagner, 2017; Kurakin et al., 2017) and corresponding defense methods have also been proposed to tackle adversarial security issues (Dzi- ugaite et al., 2016; Xie et al., 2018; Kurakin et al., 2017; Tram`er et al., 2018). However, crafting textual adversarial samples is more challenging due to the discrete and non- differentiable nature of text space. Indeed, most existing works focus on a single granularity of modification strategies, such as sentence-level (Jia and Liang, 2017; Iyyer et al., 2018), word-level (Zang et al., 2020; Ren et al., 2019) or character- level (Eger et al., …

Content truncated to 500 words