论文标题
Semattack：通过不同语义空间的自然文本攻击
SemAttack: Natural Textual Attacks via Different Semantic Spaces
论文作者
论文摘要
最近的研究表明，预训练的语言模型（LMS）容易受到文本对抗性攻击的影响。但是，现有的攻击方法要么遭受低攻击成功率，要么无法在指数大的扰动空间中有效搜索。我们提出了一个有效有效的框架Semattack，通过构建不同的语义扰动函数来生成自然的对抗文本。特别是，Semattack优化了限制在通用语义空间的生成的扰动，包括错字空间，知识空间（例如WordNet），上下文化的语义空间（例如，BERT群集的嵌入空间）或这些空间的组合。因此，生成的对抗文本在语义上更接近原始输入。广泛的实验表明，最新的（SOTA）大规模LMS（例如Deberta-V2）和防御策略（例如FreeLB）仍然容易受到Semattack的影响。我们进一步证明，Semattack是一般的，能够为具有较高攻击成功率的不同语言（例如英语和中文）生成自然的对抗文本。人类评估还证实，我们产生的对抗文本是自然的，几乎不会影响人类的绩效。我们的代码可在https://github.com/ai-secure/semattack上公开获取。
Recent studies show that pre-trained language models (LMs) are vulnerable to textual adversarial attacks. However, existing attack methods either suffer from low attack success rates or fail to search efficiently in the exponentially large perturbation space. We propose an efficient and effective framework SemAttack to generate natural adversarial text by constructing different semantic perturbation functions. In particular, SemAttack optimizes the generated perturbations constrained on generic semantic spaces, including typo space, knowledge space (e.g., WordNet), contextualized semantic space (e.g., the embedding space of BERT clusterings), or the combination of these spaces. Thus, the generated adversarial texts are more semantically close to the original inputs. Extensive experiments reveal that state-of-the-art (SOTA) large-scale LMs (e.g., DeBERTa-v2) and defense strategies (e.g., FreeLB) are still vulnerable to SemAttack. We further demonstrate that SemAttack is general and able to generate natural adversarial texts for different languages (e.g., English and Chinese) with high attack success rates. Human evaluations also confirm that our generated adversarial texts are natural and barely affect human performance. Our code is publicly available at https://github.com/AI-secure/SemAttack.
