Contextualized Perturbation for Textual Adversarial Attack

2020/09/16 by Dianqi Li, Li, Dianqi, Yizhe Zhang +13 · 11 citations
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Computation and Language (cs.CL) #FOS: Computer and information sciences #Topic Modeling #cs.CL

paper · pdf · doi:10.48550/arxiv.2009.07502

Accepted by NAACL 2021, long paper

openalex publication_date 2020/09/16 · arxiv created 2021/03/15 · arxiv updated 2021/03/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Adversarial examples expose the vulnerabilities of natural language processing (NLP) models, and can be used to evaluate and improve their robustness. Existing techniques of generating such examples are typically driven by local heuristic rules that are agnostic to the context, often resulting in unnatural and ungrammatical outputs. This paper presents CLARE, a ContextuaLized AdversaRial Example generation model that produces fluent and grammatical outputs through a mask-then-infill procedure. CLARE builds on a pre-trained masked language model and modifies the inputs in a context-aware manner. We propose three contextualized perturbations, Replace, Insert and Merge, allowing for generating outputs of varied lengths. With a richer range of available strategies, CLARE is able to attack a victim model more efficiently with fewer edits. Extensive experiments and human evaluation demonstrate that CLARE outperforms the baselines in terms of attack success rate, textual similarity, fluency and grammaticality.

Citations

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• LLM-Supported Manufacturing Mapping Generation
• Weight Poisoning Attacks on Pre-trained Models
• T3: Tree-Autoencoder Constrained Adversarial Text Generation for Targeted Attack
• Natural Language Adversarial Defense through Synonym Encoding

Cited by

• DAMASHA: Detecting AI in Mixed Adversarial Texts via Segmentation with Human-interpretable Attribution
• AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness
• Selective Adversarial Attacks on LLM Benchmarks
• Overcoming Black-box Attack Inefficiency with Hybrid and Dynamic Select Algorithms
• RedHerring Attack: Testing the Reliability of Attack Detection
• Improving Text Generation with Student-Forcing Optimal Transport
• Speaker-Oriented Latent Structures for Dialogue-Based Relation Extraction
• Coordinated Robustness Evaluation Framework for Vision-Language Models
• Can LLMs Deceive CLIP? Benchmarking Adversarial Compositionality of Pre-trained Multimodal Representation via Text Updates
• CAMOUFLAGE: Exploiting Misinformation Detection Systems Through LLM-driven Adversarial Claim Transformation
• NLP Security and Ethics, in the Wild

Related

• Adversarial Text Generation with Dynamic Contextual Perturbation
• A Context Aware Approach for Generating Natural Language Attacks
• A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement
• Phrase-level Textual Adversarial Attack with Label Preservation
• The Best Defense is Attack: Repairing Semantics in Textual Adversarial Examples