Adversaries may look to steal or attack black-box NLP systems, either for financial gain or to exploit model errors. One setting of particular interest is machine translation (MT), where models have high commercial value and errors can be costly. We investigate possible exploits of black-box MT systems and explore a preliminary defense against such threats. We first show that MT systems can be stolen by querying them with monolingual sentences and training models to imitate their outputs. Using simulated experiments, we demonstrate that MT model stealing is possible even when imitation models have different input data or architectures than their target models. Applying these ideas, we train imitation models that reach within 0.6 BLEU of three production MT systems on both high-resource and low-resource language pairs. We then leverage the similarity of our imitation models to transfer adversarial examples to the production systems. We use gradient-based attacks that expose inputs which lead to semantically-incorrect translations, dropped content, and vulgar model outputs. To mitigate these vulnerabilities, we propose a defense that modifies translation outputs in order to misdirect the optimization of imitation models. This defense degrades the adversary's BLEU score and attack success rate at some cost in the defender's BLEU and inference speed.
The University of Melbourne（墨尔本大学）；Monash University（莫纳什大学）；Sony AI（索尼人工智能）；ANU（澳大利亚国立大学）；Data61 CSIRO（联邦科学与工业研究组织数据61研究所）
Machine-learning-as-a-service (MLaaS) has attracted millions of users to their splendid large-scale models. Although published as black-box APIs, the valuable models behind these services are still vulnerable to imitation attacks. Recently, a series of works have demonstrated that attackers manage to steal or extract the victim models. Nonetheless, none of the previous stolen models can outperform the original black-box APIs. In this work, we conduct unsupervised domain adaptation and multi-victim ensemble to showing that attackers could potentially surpass victims, which is beyond previous un…
In this work, we evaluate the adversarial robustness of BERT models trained on German Hate Speech datasets. We also complement our evaluation with two novel white-box character and word level attacks thereby contributing to the range of attacks available. Furthermore, we also perform a comparison of two novel character-level defense strategies and evaluate their robustness with one another.
DoubtProbe: Black-Box Jailbreak Defense via Structural Verification and Semantic Auditing
East China Normal University（东华大学）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）
Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrations
University of Southern California（南加州大学）；Harvard University（哈佛大学）；University of California, Davis（加州大学戴维斯分校）；University of Wisconsin-Madison（威斯康星大学麦迪逊分校）
Tsinghua University（清华大学）；IDG/McGovern Institute of Brain Research（IDG/麦戈文脑科学研究院）
Automatic speech recognition (ASR) systems based on deep neural networks are weak against adversarial perturbations. We propose mixPGD adversarial training method to improve the robustness of the model for ASR systems. In standard adversarial training, adversarial samples are generated by leveraging supervised or unsupervised methods. We merge the capabilities of both supervised and unsupervised approaches in our method to generate new adversarial samples which aid in improving model robustness. Extensive experiments and comparison across various state-of-the-art defense methods and adversaria…
