基于行为克隆的多粒度文本对抗攻击
Multi-granularity Textual Adversarial Attack with Behavior Cloning
摘要：
近年来，文本对抗攻击模型由于其在评估自然语言处理模型鲁棒性方面的成功而越来越受到人们的关注。然而，现有的工作有明显的不足之处。(1)它们通常只考虑单个粒度的修改策略（例如词级或句子级），这不足以探索用于生成的整体文本空间;（2）它们需要查询受害者模型数百次才能进行成功的攻击，这在实践中是非常低效的。为了解决这些问题，在本文中，我们提出了MAYA，一个多粒度攻击模型，以有效地生成高质量的对抗性样本，减少对受害者模型的查询。此外，我们提出了一个基于学习的方法来训练一个多粒度的攻击代理通过行为克隆与我们的MAYA算法的专家知识，以进一步减少查询次数。此外，我们还调整代理攻击黑盒模型，只输出标签没有信心分数。我们在两种不同的黑盒攻击设置和三个基准数据集上对BiLSTM、BERT和RoBERTa进行了全面的实验，以评估我们的攻击模型。实验结果表明，与基线模型相比，我们的模型实现了更好的攻击性能，并产生了更流畅和语法对抗性的样本。此外，我们的对抗攻击代理显着减少了在两种攻击设置的查询时间。我们的代码在https://github.com/Yangyi-Chen/MAYA上发布。
英文摘要：
Recently, the textual adversarial attack models become increasingly popular due to their successful in estimating the robustness of NLP models. However, existing works have obvious deficiencies. (1) They usually consider only a single granularity of modification strategies (e.g. word-level or sentence-level), which is insufficient to explore the holistic textual space for generation; (2) They need to query victim models hundreds of times to make a successful attack, which is highly inefficient in practice. To address such problems, in this paper we propose MAYA, a Multi-grAnularitY Attack model to effectively generate high-quality adversarial samples with fewer queries to victim models. Furthermore, we propose a reinforcement-learning based method to train a multi-granularity attack agent through behavior cloning with the expert knowledge from our MAYA algorithm to further reduce the query times. Additionally, we also adapt the agent to attack black-box models that only output labels without confidence scores. We conduct comprehensive experiments to evaluate our attack models by attacking BiLSTM, BERT and RoBERTa in two different black-box attack settings and three benchmark datasets. Experimental results show that our models achieve overall better attacking performance and produce more fluent and grammatical adversarial samples compared to baseline models. Besides, our adversarial attack agent significantly reduces the query times in both attack settings. Our codes are released at https://github.com/Yangyi-Chen/MAYA.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
