BERT-ATTACK: Adversarial Attack against BERT Using BERT

By Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, Xipeng Qiu. 2020

900 citations recorded by the source corpus.

Adversarial attacks for discrete data (such as text) has been proved significantly more challenging than continuous data (such as image), since it is difficult to generate adversarial samples with gradient-based methods. Currently, the successful attack methods for text usually adopt heuristic replacement strategies on character or word level, which remains challenging to find the optimal solution in the massive space of possible combination of replacements, while preserving semantic consistency and language fluency. In this paper, we propose \textbf{BERT-Attack}, a high-quality and effective method to generate adversarial samples using pre-trained masked language models exemplified by BERT. We turn BERT against its fine-tuned models and other deep neural models for downstream tasks. Our method successfully misleads the target models to predict incorrectly, outperforming state-of-the-art attack strategies in both success rate and perturb percentage, while the generated adversarial samples are fluent and semantically preserved. Also, the cost of calculation is low, thus possible for large-scale generations.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Pre-Trained Models: Past, Present and Future (2021, background): “Adversarial defenses (Si et al., 2020; Yao et al., 2021; Li and Qiu, 2021) for PTMs are also promising, which can improve the robustness of PTMs and make them immune against adversarial attacks.”
Pre-trained models for natural language processing: A survey (2020, background): “[240] proposed BERT-Attack, a BERT-based high-quality and effective attacker.”
Token-Aware Virtual Adversarial Training in Natural Language Understanding (2021, methodology): “Instead of using gradients to craft perturbations, most common methods usually replace the original texts based on certain rules such as replacing words with semantically similar words (Alzantot et al. 2018; Jin et al. 2019; Li et al. 2020).”
Contextualized Perturbation for Textual Adversarial Attack (2020, background): “Generating adversarial examples with masked language models is also explored by a concurrent work (Li et al., 2020).”
Baseline Defenses for Adversarial Attacks Against Aligned Language Models (2023, background): “Finally, note that attacks on (non-generative) text classifiers have existed for some time (Gao et al., 2018; Li et al., 2018; Ebrahimi et al., 2018; Li et al., 2020; Morris et al., 2020; Guo et al., 2021), and were developed in parallel to attacks on image classifiers.”
Prompting GPT-3 To Be Reliable (2022, background): “…forms of adversarial attacks can break LLMs even by just strategic synonym substitution, paraphrase, or distractor insertion (Jin et al., 2020; Li et al., 2020; Ribeiro et al., 2018; Si et al., 2019; 2021a; Jia & Liang, 2017; Si et al., 2021b); LLMs have been shown to exploit shortcuts or…”
Auditing large language models: a three-layered approach (2023, background): “Second, the risk of adversarial attacks [190], [191].”
Bridging the Gap Between Indexing and Retrieval for Differentiable Search Index with Query Generation (2022, background): “It is well-known that pre-trained language models are not robust to data distribution drift between training (“indexing”) and inference (retrieval) [23, 24, 33, 46, 54, 57]: we thus argue that the original DSI model might be sub-optimal.”
ReCode: Robustness Evaluation of Code Generation Models (2022, methodology): “, 2020) predictions with highest aggregated scores according to the context around all its appearance, a method inspired by (Jha and Reddy, 2022; Li et al., 2020), (2) using NatGen style renaming as "VAR_0", and (3) random name generation with half alphabetic and half numeric characters.”
HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal (2024, neutral): “Numerous attacks specific to text models have been proposed (Ebrahimi et al., 2017; Iyyer et al., 2018; Li et al., 2018; Jin et al., 2020; Li et al., 2020; Guo et al., 2021), as well as specific high-quality benchmarks for text attacks (Wang et al., 2021).”
Generating Adversarial Examples in Chinese Texts Using Sentence-Pieces (2020, positive): “Most replacing strategies incorporate a synonym dictionary (Dong et al., 2010; Fellbaum, 1998) or use word embeddings (Pennington et al., 2014; Mrkˇsi´c et al., 2016; Jin et al., 2019).”
A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement (2022, background): “[Ren et al., 2019; Li et al., 2020; Wang et al., 2021] adopt the adversarial examples generated by their attack methods for adversarial training and achieve robustness improvement.”
Explaining NLP Models via Minimal Contrastive Editing (MiCE) (2020, methodology): “Recent methods for generating adversarial examples also preserve ﬂuency (Zhang et al., 2019; Li et al., 2020b; Song et al., 2020) 15 ; however, adversarial examples are designed to ﬁnd erroneous change in model outputs; contrastive edits place no such constraint on model correctness.”
Better Robustness by More Coverage: Adversarial Training with Mixup Augmentation for Robust Fine-tuning (2020, methodology): “However, recent works have shown the ﬂaws of these PLMs in terms of robustness (Jin et al., 2020; Zang et al., 2020; Si et al., 2020; Li et al., 2020; Garg and Ramakrishnan, 2020; Tan et al., 2020; Wang et al., 2020a), where PLMs ﬁne-tuned on various downstream datasets are easily fooled by…”
Global Explainability of BERT-Based Evaluation Metrics by Disentangling along Linguistic Factors (2021, background): “…that all metrics capture these linguistic aspects to certain (but differing) degrees, and they are particularly sensitive to lexical overlap, which makes them prone to similar adversarial fooling (cf. Li et al., 2020; Eger et al., 2019; Keller et al., 2021) as BLEU-based lexical overlap metrics.”
Gradient-based Adversarial Attacks against Text Transformers (2021, background): “For attacks that operate on the character level, perceptibility can be approximated by the number of character ed-its, i.e. , replacements, swaps, insertions and deletions (Ebrahimi et al., 2017; Li et al., 2018; Gao et al., 2018).”
CLINE: Contrastive Learning with Semantic Negative Examples for Natural Language Understanding (2021, positive): “As stated in the observations in Section 2, we explore strategies that could improve the sensitivity of PLMs.”