Generating Fluent Adversarial Examples for Natural Languages

By Huangzhao Zhang, Hao Zhou, Ning Miao, Lei Li. 2019

158 citations recorded by the source corpus.

Efficiently building an adversarial attacker for natural language processing (NLP) tasks is a real challenge. Firstly, as the sentence space is discrete, it is difficult to make small perturbations along the direction of gradients. Secondly, the fluency of the generated examples cannot be guaranteed. In this paper, we propose MHA, which addresses both problems by performing Metropolis-Hastings sampling, whose proposal is designed with the guidance of gradients. Experiments on IMDB and SNLI show that our proposed MHAoutperforms the baseline model on attacking capability. Adversarial training with MHA also leads to better robustness and performance.

Subfields: Artificial Intelligence, Natural Language Processing, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Natural Language Processing

In Safety, Robustness & Interpretability

Citations in the corpus

Polyjuice: Generating Counterfactuals for Explaining, Evaluating, and Improving Models (2021, methodology): “HANS (McCoy et al., 2019), a challenge set for NLI, contains 10k pairs of premises and hypotheses created based on 10 heavily fallible syntactic templates, and therefore compensates rarer structural changes that may be missed by PAWS.”
Substructure Substitution: Structured Data Augmentation for NLP (2021, background): “…examples which help improve the robustness of neural network– based NLP models (Belinkov and Bisk, 2018; Shi et al., 2018a; Alzantot et al., 2018; Zhang et al., 2019; Min et al., 2020, inter alia ), or to generate counterfactual examples which mitigate bias in natural language (Zmigrod et al.,…”
Explaining NLP Models via Minimal Contrastive Editing (MiCE) (2020, methodology): “Recent methods for generating adversarial examples also preserve ﬂuency (Zhang et al., 2019; Li et al., 2020b; Song et al., 2020) 15 ; however, adversarial examples are designed to ﬁnd erroneous change in model outputs; contrastive edits place no such constraint on model correctness.”
Better Robustness by More Coverage: Adversarial Training with Mixup Augmentation for Robust Fine-tuning (2020, methodology): “This is the evaluation method adopted in (Zhang et al., 2019; Huang et al., 2019; Jia et al., 2019; Li et al., 2020; Zang et al., 2020; Li and Qiu, 2021, inter alia.”
Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey (2019, methodology): “An edit-based approach MHA (Metropolis-Hastings Attack) was proposed aiming to provide fluent and effective adversarial attacks [156].”
Contextualized Perturbation for Textual Adversarial Attack (2020, background): “(Best viewed in color). synonym substitution rules to enhance semantic meaning preservation (Alzantot et al., 2018; Jin et al., 2020; Ren et al., 2019; Zhang et al., 2019; Zang et al., 2020, inter alia).”
On Evaluating Adversarial Robustness of Large Vision-Language Models (2023, background): “…flexible (e.g., beyond word replacement) and semantically preserving methods are proposed to produce natural language adversarial examples [9, 49, 50, 52, 53, 70, 78, 102, 104, 110], as well as benchmarks and datasets to more thoroughly evaluate the adversarial robustness of LMs [56, 90–92].”