首页/论文/2109.04775

arXiv 2109.047752021-09-10cs.CL

A Strong Baseline for Query Efficient Attacks in a Black Box Setting

International Institute of Information Technology, Hyderabad（海得拉巴国际信息技术学院）

Rishabh Maheshwary, Saket Maheshwary, Vikram Pudi

备注：: EMNLP 2021 - Main Conference

阅读 PDF ↗

arXiv 页面 ↗HTML 原文 ↗

英文摘要相关论文

英文摘要：

Existing black box search methods have achieved high success rate in generating adversarial attacks against NLP models. However, such search methods are inefficient as they do not consider the amount of queries required to generate adversarial attacks. Also, prior attacks do not maintain a consistent search space while comparing different search methods. In this paper, we propose a query efficient attack strategy to generate plausible adversarial examples on text classification and entailment tasks. Our attack jointly leverages attention mechanism and locality sensitive hashing (LSH) to reduce the query count. We demonstrate the efficacy of our approach by comparing our attack with four baselines across three different search spaces. Further, we benchmark our results across the same search space used in prior attacks. In comparison to attacks proposed, on an average, we are able to reduce the query count by 75% across all datasets and target models. We also demonstrate that our attack achieves a higher success rate when compared to prior attacks in a limited query setting.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

阅读原文

阅读 PDF ↗

arXiv 页面 ↗HTML 原文 ↗

本文内容

英文摘要相关论文

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

继续探索

相关论文

Model Robustness with Text Classification: Semantic-preserving adversarial attacks

Wells Fargo（富国银行）

We propose algorithms to create adversarial attacks to assess model robustness in text classification problems. They can be used to create white box attacks and black box attacks while at the same time preserving the semantics and syntax of the original text. The attacks cause significant number of flips in white-box setting and same rule based can be used in black-box setting. In a black-box setting, the attacks created are able to reverse decisions of transformer based architectures.

2020-08-14cs.CLcs.LG

TextDecepter: Hard Label Black Box Attack on Text Classifiers

Rutgers University（罗格斯大学）

Machine learning has been proven to be susceptible to carefully crafted samples, known as adversarial examples. The generation of these adversarial examples helps to make the models more robust and gives us an insight into the underlying decision-making of these models. Over the years, researchers have successfully attacked image classifiers in both, white and black-box settings. However, these methods are not directly applicable to texts as text data is discrete. In recent years, research on crafting adversarial examples against textual applications has been on the rise. In this paper, we pre…

2020-12-28cs.CLcs.CRcs.LG

White-Box Attacks on Hate-speech BERT Classifiers in German with Explicit and Implicit Character Level Defense

In this work, we evaluate the adversarial robustness of BERT models trained on German Hate Speech datasets. We also complement our evaluation with two novel white-box character and word level attacks thereby contributing to the range of attacks available. Furthermore, we also perform a comparison of two novel character-level defense strategies and evaluate their robustness with one another.

2022-02-14cs.CL

$B^4$：针对LLM水印的黑盒擦除攻击

$B^4$: A Black-Box Scrubbing Attack on LLM Watermarks

Peking Univerisity（北京大学）；University of California Santa Barbara（加州大学圣巴巴拉分校）

提出$B^4$黑盒水印擦除攻击，将攻击形式化为约束优化问题，通过代理分布求解，在12种设置下优于基线。

2024-11-07cs.CL

OASIS：针对硬标签黑盒文本攻击优化攻击者序列

OASIS: Optimizing Attacker Sequences for Hard-Label Black-Box Text Attacks

School of Information Science and Technology（信息科学与技术学院）；Guangdong University of Foreign Studies（广东外语外贸大学）

OASIS通过双目标攻击链搜索优化硬标签黑盒文本攻击的攻击者序列，在多数据集、多模型上性能优于基线，为提升攻击效果提供新优化方向。

2026-09-02cs.CLcs.CR

Leveraging Extracted Model Adversaries for Improved Black Box Attacks

Oracle Corporation（甲骨文公司）；Oracle Labs（甲骨文实验室）

We present a method for adversarial input generation against black box models for reading comprehension based question answering. Our approach is composed of two steps. First, we approximate a victim black box model via model extraction (Krishna et al., 2020). Second, we use our own white box method to generate input perturbations that cause the approximate model to fail. These perturbed inputs are used against the victim. In experiments we find that our method improves on the efficacy of the AddAny---a white box attack---performed on the approximate model by 25% F1, and the AddSent attack---a…

2020-11-02cs.AIcs.CLcs.LG

更多相关论文收起更多论文

关于群组查询幻觉攻击的研究

An Investigation on Group Query Hallucination Attacks

University of Science and Technology of China（中国科学技术大学）；Purdue University（帕克大学）

本文提出群组查询攻击，通过同时向大语言模型提交多个查询，发现其会显著降低微调模型性能、触发潜在后门，并影响预训练与对齐模型的推理任务表现。

2025-08-26cs.AIcs.CLcs.CR

Adversarial Attacks on Spoofing Countermeasures of automatic speaker verification

The Chinese University of Hong Kong（香港中文大学）；National Taiwan University（国立台湾大学）

High-performance spoofing countermeasure systems for automatic speaker verification (ASV) have been proposed in the ASVspoof 2019 challenge. However, the robustness of such systems under adversarial attacks has not been studied yet. In this paper, we investigate the vulnerability of spoofing countermeasures for ASV under both white-box and black-box adversarial attacks with the fast gradient sign method (FGSM) and the projected gradient descent (PGD) method. We implement high-performing countermeasure models in the ASVspoof 2019 challenge and conduct adversarial attacks on them. We compare per…

2019-10-19cs.CLeess.AS

Query2box: Reasoning over Knowledge Graphs in Vector Space using Box Embeddings

Stanford University（斯坦福大学）

Answering complex logical queries on large-scale incomplete knowledge graphs (KGs) is a fundamental yet challenging task. Recently, a promising approach to this problem has been to embed KG entities as well as the query into a vector space such that entities that answer the query are embedded close to the query. However, prior work models queries as single points in the vector space, which is problematic because a complex query represents a potentially large set of its answer entities, but it is unclear how such a set can be represented as a single point. Furthermore, prior work can only handl…

2020-02-29cs.CLcs.LGstat.ML

利用类别概率进行黑盒句子级攻击

Exploiting Class Probabilities for Black-box Sentence-level Attacks

Arizona State University（亚利桑那州立大学）

本文提出一种利用类别概率反馈的黑盒句子级攻击新算法，克服了现有方法仅用标签或无反馈的局限，并通过多分类器和基准数据集上的广泛评估验证了其有效性。

2024-02-21cs.AIcs.CLcs.CR

Grey-box Adversarial Attack And Defence For Sentiment Classification

IBM Research（IBM研究院）；University of Melbourne（墨尔本大学）

We introduce a grey-box adversarial attack and defence framework for sentiment classification. We address the issues of differentiability, label preservation and input reconstruction for adversarial attack and defence in one unified framework. Our results show that once trained, the attacking model is capable of generating high-quality adversarial examples substantially faster (one order of magnitude less in time) than state-of-the-art attacking methods. These examples also preserve the original sentiment according to human evaluation. Additionally, our framework produces an improved classifie…

2021-03-22cs.AIcs.CLcs.LG

Q-FAKER: 通过受控生成实现无查询的硬黑盒攻击

Q-FAKER: Query-free Hard Black-box Attack via Controlled Generation

College of Computing and Informatics（计算机与信息学院）；Sungkyunkwan University（全南大学）

针对硬黑盒场景下语言模型对抗攻击需大量查询、高训练成本的问题，提出无需访问目标模型的Q-faker方法，通过受控生成替代模型生成对抗样本，实现高效攻击且具高转移性与实用性。

2025-04-18cs.AIcs.CLcs.CR

Student Surpasses Teacher: Imitation Attack for Black-Box NLP APIs

The University of Melbourne（墨尔本大学）；Monash University（莫纳什大学）；Sony AI（索尼人工智能）；ANU（澳大利亚国立大学）；Data61 CSIRO（联邦科学与工业研究组织数据61研究所）

Machine-learning-as-a-service (MLaaS) has attracted millions of users to their splendid large-scale models. Although published as black-box APIs, the valuable models behind these services are still vulnerable to imitation attacks. Recently, a series of works have demonstrated that attackers manage to steal or extract the victim models. Nonetheless, none of the previous stolen models can outperform the original black-box APIs. In this work, we conduct unsupervised domain adaptation and multi-victim ensemble to showing that attackers could potentially surpass victims, which is beyond previous un…

2022-09-04cs.CLcs.CRcs.LG

Kov：基于马尔可夫决策过程与树搜索的可迁移、自然化黑盒大语言模型攻击

Kov: Transferable and Naturalistic Black-Box LLM Attacks using Markov Decision Processes and Tree Search

Stanford University（斯坦福大学）

该研究提出Kov算法，将红队问题建模为MDP并结合蒙特卡洛树搜索，通过白盒LLM优化token级对抗提示后缀并加入自然化损失，仅用10次查询即可越狱GPT-3.5，验证了新模型对token级攻击的更强鲁棒性，相关代码已开源。

2024-08-11cs.AIcs.CLcs.CR