Universal Adversarial Attacks on Text Classifiers

By Melika Behjati, Seyed-Mohsen Moosavi-Dezfooli, Mahdieh Soleymani Baghshah, Pascal Frossard. 2019

110 citations recorded by the source corpus.

Despite the vast success neural networks have achieved in different application domains, they have been proven to be vulnerable to adversarial perturbations (small changes in the input), which lead them to produce the wrong output. In this paper, we propose a novel method, based on gradient projection, for generating universal adversarial perturbations for text; namely sequence of words that can be added to any input in order to fool the classifier with high probability. We observed that text classifiers are quite vulnerable to such perturbations: inserting even a single adversarial word to the beginning of every input sequence can drop the accuracy from 93% to 50%.

Subfields: Artificial Intelligence, Sociology and Political Science, Natural Language Processing, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

In Natural Language Processing

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Red Teaming Language Models with Language Models (2022, methodology): “Such methods find inputs that elicit inaccurate predictions from text classifiers (Hosseini et al., 2017; Ebrahimi et al., 2018; Behjati et al., 2019, inter alia) and offensive text from LMs (Wallace et al., 2019; He and Glass, 2019; Liu et al., 2019; Song et al., 2020; Liu et al., 2020; Yu and…”
Universal Adversarial Triggers for NLP (2019, background): “In parallel work, Behjati et al. (2019) consider universal adversarial attacks on text classification (compare to our Section 3).”
Universal Adversarial Attacks with Natural Triggers for Text Classification (2020, background): “, 2019; Behjati et al., 2019) are a sub-class of these methods where the same attack perturbation can be applied to any input to the target classifier. These attacks, being input-agnostic, point to more serious shortcomings in trained models since they do not require re-generation for each input. Ho”
A Survey On Universal Adversarial Attack (2021, methodology): “The UAP for text is defined as a sequence of words that can be added to any input sentence in order and lead to a significant accuracy drop for the text classifier[Behjati et al., 2019].”