Contextualized Perturbation for Textual Adversarial Attack

By Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, Bill Dolan. 2020

285 citations recorded by the source corpus.

Adversarial examples expose the vulnerabilities of natural language processing (NLP) models, and can be used to evaluate and improve their robustness. Existing techniques of generating such examples are typically driven by local heuristic rules that are agnostic to the context, often resulting in unnatural and ungrammatical outputs. This paper presents CLARE, a ContextuaLized AdversaRial Example generation model that produces fluent and grammatical outputs through a mask-then-infill procedure. CLARE builds on a pre-trained masked language model and modifies the inputs in a context-aware manner. We propose three contextualized perturbations, Replace, Insert and Merge, that allow for generating outputs of varied lengths. CLARE can flexibly combine these perturbations and apply them at any position in the inputs, and is thus able to attack the victim model more effectively with fewer edits. Extensive experiments and human evaluation demonstrate that CLARE outperforms the baselines in terms of attack success rate, textual similarity, fluency and grammaticality.

Subfields: Artificial Intelligence, Natural Language Processing, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Natural Language Processing

In Safety, Robustness & Interpretability

Citations in the corpus

Polyjuice: Generating Counterfactuals for Explaining, Evaluating, and Improving Models (2021, background): “For example, adversarial generators aim to maintain semantics while changing model predictions (Ribeiro et al., 2018; Iyyer et al., 2018; Li et al., 2021), whereas concurrent work to our own (Madaan et al.”
NL-Augmenter: A Framework for Task-Sensitive Natural Language Augmentation (2021, background): “This perturbation would benefit all tasks which have a sentence/paragraph/document as input like text classification and text generation, especially on tasks related to understanding/generating scripts.”
Gradient-based Adversarial Attacks against Text Transformers (2021, methodology): “For instance, BERT-Attack (Li et al., 2020b)— arguably the state-of-the-art attack against BERT— only reduces the test accuracy of the target model on the AG News dataset (Zhang et al., 2015) from 94 .”
Automatically Exposing Problems with Neural Dialog Models (2021, background): “…Neural Models Similar to generating adversarial examples to fool natural language understanding models (Zhang et al., 2019b; Jin et al., 2020; Li et al., 2021; Song et al., 2021), Wallace et al. (2019); Sheng et al. (2020) show that some learned discrete non-sensical universal triggers can…”
Sometimes We Want Ungrammatical Translations (2021, methodology): “When perturbation has been used to evaluate model performance, the utilized perturbation functions have been predominantly fairly simple, including reverse and word shuffle, and usually target only single sentences (Ettinger, 2020; Li et al., 2020; Sinha et al., 2020).”
From Pretraining Data to Language Models to Downstream Tasks: Tracking the Trails of Political Biases Leading to Unfair NLP Models (2023, background): “Pretrained language models are sensitive to minor changes and perturbations in the input text (Li et al., 2021; Wang et al.)”
Explainability for Large Language Models: A Survey (2023, background): “Alternatively, conventional supervised classification can also be adopted to find important neurons in a given model [Dalvi et al. 2019].”