Character-level White-Box Adversarial Attacks against Transformers via Attachable Subwords Substitution (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods to attack transformer models are not effective at character level, but they are a natural attack scenario. |
| Approach: | They propose a character-level adversarial attack method against transformer models . they use a gradient-based method to find the most vulnerable words in a sentence . |
| Outcome: | The proposed method outperforms previous methods on sentence-level and token-level tasks. |
Similar Papers
Gradient-based Adversarial Attacks against Text Transformers (2021.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for obtaining adversarial examples are difficult with text data. |
| Approach: | They propose a gradient-based adversarial attack against transformer models that searches for a distribution of adversarials parameterized by a continuous-valued matrix. |
| Outcome: | The proposed attack outperforms existing methods on a variety of natural language tasks with matching imperceptibility. |
On Adversarial Examples for Character-Level Neural Machine Translation (C18-1)
Copied to clipboard
| Challenge: | Using adversarial examples to measure robustness of deep learning models has become a standard procedure due to the difficulty of creating white-box adversarials for discrete text input. |
| Approach: | They propose two novel attacks which aim to remove or change a word in a translation, rather than simply break the NMT. |
| Outcome: | The proposed attacks are significantly stronger than their black-box counterparts in different attack scenarios, showing more serious vulnerabilities than previously known. |
Combining Subword Representations into Word-level Representations in the Transformer Architecture (2020.acl-srw)
Copied to clipboard
| Challenge: | Currently dominant approaches use word-level tokens, but this increases the length of the sequences and makes it difficult to profit from word-based information. |
| Approach: | They propose to combine subword-level representations into word-level ones in the first layers of the encoder, reducing the effective length of the sequences in the following layers. |
| Outcome: | The proposed model maintains translation quality with no extra word-level information . it is superior to the current dominant method for incorporating word- level source language information a priori . |
Word-level Textual Adversarial Attacking as Combinatorial Optimization (2020.acl-main)
Copied to clipboard
| Challenge: | Existing word-level attack models are far from perfect because of unsuitable search space reduction methods and inefficient optimization algorithms. |
| Approach: | They propose a novel adversarial adversarialist model that incorporates word substitution and particle swarm optimization to solve two problems separately. |
| Outcome: | The proposed model achieves much higher success rates and crafts more high-quality adversarial examples as compared to baseline methods. |
HotFlip: White-Box Adversarial Examples for Text Classification (P18-2)
Copied to clipboard
| Challenge: | Existing methods to create adversarial examples without explicit knowledge of model parameters are not effective. |
| Approach: | They propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier by an atomic flip operation. |
| Outcome: | The proposed method can be adapted to attack a word-level classifier with a few constraints. |
Towards Reasonably-Sized Character-Level Transformer NMT by Finetuning Subword Systems (2020.emnlp-main)
Copied to clipboard
| Challenge: | Existing approaches to train character-level models require very deep architectures that are difficult and slow to train. |
| Approach: | They propose to fine tune a Transformer token-based model to get a model without token segmentation. |
| Outcome: | The proposed model improves translation quality and robustness to noise while requiring less token segmentation. |
TAG: Gradient Attack on Transformer-based Language Models (2021.findings-emnlp)
Copied to clipboard
Jieren Deng, Yijue Wang, Ji Li, Chenghong Wang, Chao Shang, Hang Liu, Sanguthevar Rajasekaran, Caiwen Ding
| Challenge: | Recent studies show that publicly shared gradients in the training process can reveal the private training data to a third-party. |
| Approach: | They propose a gradient attack algorithm to reconstruct the local training data using GLUE benchmarks. |
| Outcome: | The proposed algorithm achieves 1.5x recover rate and 2.5x ROUGE-2 over previous methods without the need of ground truth label. |
Step by Step Loss Goes Very Far: Multi-Step Quantization for Adversarial Text Attacks (2023.eacl-main)
Copied to clipboard
| Challenge: | Existing gradient-based attacks quantize all tokens in a text at once, which creates a significant gap between adversarial loss for continuous and discrete text representations. |
| Approach: | They propose a gradient-based attack that quantizes tokens one by one and reoptimizes adversarial example after each quantization. |
| Outcome: | The proposed method outperforms other approaches on various natural language processing tasks. |
Searching for an Effective Defender: Benchmarking Defense against Adversarial Word Substitution (2021.emnlp-main)
Copied to clipboard
Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, Cho-Jui Hsieh
| Challenge: | Existing methods to defend against adversarial word-substitution attacks have not been evaluated or compared in a systematic manner. |
| Approach: | They propose to compare different defense methods under representative adversarial attacks . they propose a method that improves the robustness of neural text classifiers against such attacks a . |
| Outcome: | The proposed method improves robustness of neural text classifiers against such attacks by a significant margin. |
BERT-Defense: A Probabilistic Model Based on BERT to Combat Cognitively Inspired Orthographic Adversarial Attacks (2021.findings-acl)
Copied to clipboard
| Challenge: | adversarial attacks expose important blind spots of deep learning systems, authors show . word and sentence-level attacks tend to be more difficult to defend via spelling correction modules . character-level attack scenarios often involve finding semantic paraphrases of input . |
| Approach: | They propose a model that probabilistically combines context-independent word level information with context-dependent information from BERT's masked language modeling to combat low-level orthographic attacks. |
| Outcome: | The proposed model outperforms a spellchecker and Pruthi's model on a character-level benchmark. |