在硬标签黑盒环境中生成自然语言攻击
Generating Natural Language Attacks in a Hard Label Black Box Setting
摘要：
我们研究了一个重要的和具有挑战性的任务，攻击自然语言处理模型中的硬标签黑盒设置。我们提出了一种基于决策的攻击策略，该策略在文本分类和蕴涵任务上制作高质量的对抗性示例。我们提出的攻击策略利用基于种群的优化算法，通过只观察目标模型预测的顶部标签来制作合理且语义相似的对抗性示例。在每次迭代中，优化过程允许单词替换，最大限度地提高原始文本和对抗文本之间的整体语义相似性。此外，我们的方法不依赖于使用替代模型或任何类型的训练数据。我们通过对七个基准数据集的五个最先进的目标模型进行广泛的实验和消融研究，证明了我们提出的方法的有效性。与先前文献中提出的攻击相比，我们能够在高度受限的设置中以较低的词扰动百分比实现更高的成功率。
英文摘要：
We study an important and challenging task of attacking natural language processing models in a hard label black box setting. We propose a decision-based attack strategy that crafts high quality adversarial examples on text classification and entailment tasks. Our proposed attack strategy leverages population-based optimization algorithm to craft plausible and semantically similar adversarial examples by observing only the top label predicted by the target model. At each iteration, the optimization procedure allow word replacements that maximizes the overall semantic similarity between the original and the adversarial text. Further, our approach does not rely on using substitute models or any kind of training data. We demonstrate the efficacy of our proposed approach through extensive experimentation and ablation studies on five state-of-the-art target models across seven benchmark datasets. In comparison to attacks proposed in prior literature, we are able to achieve a higher success rate with lower word perturbation percentage that too in a highly restricted setting.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
