arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2402.03477cs.CL

基于BERT的阿拉伯语同义词对抗样本用于文本分类

Arabic Synonym BERT-based Adversarial Examples for Text Classification

Clarkson University(克拉克森大学)

Norah Alshahrani, Saied Alshahrani, Esma Wali, Jeanna Matthews

AI总结:

本文首次对阿拉伯语文本分类进行词级对抗攻击研究,提出基于BERT的MLM同义词攻击方法,发现微调BERT模型更易受攻击,且对抗训练可恢复至少2%准确率。

摘要:

文本分类系统已被证明容易受到对抗性文本示例的攻击,这些示例是原始文本示例的修改版本,通常人类难以察觉,却能迫使文本分类模型改变其分类结果。通常,量化对抗性文本攻击影响的研究工作仅应用于以英语训练的模型。在本文中,我们首次引入了阿拉伯语对抗性攻击的词级研究。具体而言,我们使用基于BERT模型的掩码语言建模(MLM)任务,在黑盒设置下采用同义词(词级)攻击,以评估最先进的文本分类模型在阿拉伯语对抗性攻击下的鲁棒性。为了评估我们基于同义词的BERT攻击所产生的新对抗示例在语法和语义上的相似性,我们邀请了四位人工评估员来评估并将产生的对抗示例与其原始示例进行比较。我们还研究了这些新产生的阿拉伯语对抗示例向各种模型的迁移性,并调查了针对这些对抗示例的防御机制在BERT模型上的有效性。我们发现,微调后的BERT模型比我们训练的其他深度神经网络(DNN)模型(如WordCNN和WordLSTM)更容易受到我们的同义词攻击。我们还发现,微调后的BERT模型更容易受到迁移攻击的影响。最后,我们发现,在应用对抗训练作为初始防御机制后,微调后的BERT模型成功恢复了至少2%的准确率。

英文摘要:

Text classification systems have been proven vulnerable to adversarial text examples, modified versions of the original text examples that are often unnoticed by human eyes, yet can force text classification models to alter their classification. Often, research works quantifying the impact of adversarial text attacks have been applied only to models trained in English. In this paper, we introduce the first word-level study of adversarial attacks in Arabic. Specifically, we use a synonym (word-level) attack using a Masked Language Modeling (MLM) task with a BERT model in a black-box setting to assess the robustness of the state-of-the-art text classification models to adversarial attacks in Arabic. To evaluate the grammatical and semantic similarities of the newly produced adversarial examples using our synonym BERT-based attack, we invite four human evaluators to assess and compare the produced adversarial examples with their original examples. We also study the transferability of these newly produced Arabic adversarial examples to various models and investigate the effectiveness of defense mechanisms against these adversarial examples on the BERT models. We find that fine-tuned BERT models were more susceptible to our synonym attacks than the other Deep Neural Networks (DNN) models like WordCNN and WordLSTM we trained. We also find that fine-tuned BERT models were more susceptible to transferred attacks. We, lastly, find that fine-tuned BERT models successfully regain at least 2% in accuracy after applying adversarial training as an initial defense mechanism.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑