arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2303.08032cs.CLcs.LG

验证自动可信度评估的鲁棒性

Verifying the Robustness of Automatic Credibility Assessment

Universitat Pompeu Fabra(庞培法布拉大学);Institute of Computer Science, Polish Academy of Sciences(波兰科学院计算机科学研究所)

Piotr Przybyła, Alexander Shvets, Horacio Saggion

AI总结:

本研究验证了自动可信度评估模型对多种攻击技术的鲁棒性,发现大型语言模型更易受攻击,提出BODEGA基准用于评估内容管理中的虚假信息检测。

摘要:

文本分类方法已被广泛研究作为检测低可信度内容(如假新闻、社交媒体机器人、宣传等)的方式。相当准确的模型(可能基于深度神经网络)有助于管理公共电子平台,常常导致内容创作者面临提交被拒绝或已发布文本被删除的情况。为了逃避进一步检测,内容创作者试图生成略微修改的文本版本(称为对抗示例攻击),利用分类器的弱点导致输出不同。在这里,我们系统地测试了常见文本分类器对可用攻击技术的鲁棒性,并发现确实存在意义保持的输入文本修改可以误导模型。我们测试的方法集中在寻找文本中的薄弱段落并替换单个字符或单词,考虑到原始内容与替换内容之间的相似性。我们还引入了BODEGA:一个用于测试受害模型和攻击方法的基准,在四个虚假信息检测任务上进行评估,以模拟内容管理的现实使用场景。受攻击的任务包括(1)事实核查和(2)偏党新闻、(3)宣传和(4)谣言。我们的实验结果表明,现代大型语言模型往往比先前较小的解决方案更容易受到攻击,例如对GEMMA的攻击比对BERT的攻击成功率高27%。最后,我们手动分析了一部分对抗示例并检查了成功攻击中使用了哪些修改。

英文摘要:

Text classification methods have been widely investigated as a way to detect content of low credibility: fake news, social media bots, propaganda, etc. Quite accurate models (likely based on deep neural networks) help in moderating public electronic platforms and often cause content creators to face rejection of their submissions or removal of already published texts. Having the incentive to evade further detection, content creators try to come up with a slightly modified version of the text (known as an attack with an adversarial example) that exploit the weaknesses of classifiers and result in a different output. Here we systematically test the robustness of common text classifiers against available attacking techniques and discover that, indeed, meaning-preserving changes in input text can mislead the models. The approaches we test focus on finding vulnerable spans in text and replacing individual characters or words, taking into account the similarity between the original and replacement content. We also introduce BODEGA: a benchmark for testing both victim models and attack methods on four misinformation detection tasks in an evaluation framework designed to simulate real use-cases of content moderation. The attacked tasks include (1) fact checking and detection of (2) hyperpartisan news, (3) propaganda and (4) rumours. Our experimental results show that modern large language models are often more vulnerable to attacks than previous, smaller solutions, e.g. attacks on GEMMA being up to 27\% more successful than those on BERT. Finally, we manually analyse a subset adversarial examples and check what kinds of modifications are used in successful attacks.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑