Contextualized Perturbation for Textual Adversarial Attack

2020/09/16 by Dianqi Li, Li, Dianqi, Yizhe Zhang +11 · 5 citations
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Computation and Language (cs.CL) #FOS: Computer and information sciences #Topic Modeling

paper · pdf · doi:10.48550/arxiv.2009.07502

openalex publication_date 2020/09/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Adversarial examples expose the vulnerabilities of natural language processing (NLP) models, and can be used to evaluate and improve their robustness. Existing techniques of generating such examples are typically driven by local heuristic rules that are agnostic to the context, often resulting in unnatural and ungrammatical outputs. This paper presents CLARE, a ContextuaLized AdversaRial Example generation model that produces fluent and grammatical outputs through a mask-then-infill procedure. CLARE builds on a pre-trained masked language model and modifies the inputs in a context-aware manner. We propose three contextualized perturbations, Replace, Insert and Merge, allowing for generating outputs of varied lengths. With a richer range of available strategies, CLARE is able to attack a victim model more efficiently with fewer edits. Extensive experiments and human evaluation demonstrate that CLARE outperforms the baselines in terms of attack success rate, textual similarity, fluency and grammaticality.

Citations

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• LLM-Supported Manufacturing Mapping Generation
• Weight Poisoning Attacks on Pre-trained Models
• T3: Tree-Autoencoder Constrained Adversarial Text Generation for Targeted Attack
• Natural Language Adversarial Defense through Synonym Encoding

Cited by

• DAMASHA: Detecting AI in Mixed Adversarial Texts via Segmentation with Human-interpretable Attribution
• AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness
• Selective Adversarial Attacks on LLM Benchmarks
• Overcoming Black-box Attack Inefficiency with Hybrid and Dynamic Select Algorithms
• RedHerring Attack: Testing the Reliability of Attack Detection

Related

• Adversarial Text Generation with Dynamic Contextual Perturbation
• A Context Aware Approach for Generating Natural Language Attacks
• A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancement
• Phrase-level Textual Adversarial Attack with Label Preservation
• The Best Defense is Attack: Repairing Semantics in Textual Adversarial Examples