[Paper Review] Adversarial Texts with Gradient Methods

Zhitao Gong, Wenlu Wang+3 more|arXiv (Cornell University)|Jan 22, 2018

Adversarial Robustness in Machine LearningComputer Science55 citations

TL;DR

The paper adapts gradient-based adversarial attacks from images to text by searching in embedding space and reconstructing via nearest neighbors, using Word Mover's Distance to measure quality, and demonstrating FGM and DeepFool on IMDB and Reuters datasets with high-quality, small-word-change adversaries.

ABSTRACT

Adversarial samples for images have been extensively studied in the literature. Among many of the attacking methods, gradient-based methods are both effective and easy to compute. In this work, we propose a framework to adapt the gradient attacking methods on images to text domain. The main difficulties for generating adversarial texts with gradient methods are i) the input space is discrete, which makes it difficult to accumulate small noise directly in the inputs, and ii) the measurement of the quality of the adversarial texts is difficult. We tackle the first problem by searching for adversarials in the embedding space and then reconstruct the adversarial texts via nearest neighbor search. For the latter problem, we employ the Word Mover's Distance (WMD) to quantify the quality of adversarial texts. Through extensive experiments on three datasets, IMDB movie reviews, Reuters-2 and Reuters-5 newswires, we show that our framework can leverage gradient attacking methods to generate very high-quality adversarial texts that are only a few words different from the original texts. There are many cases where we can change one word to alter the label of the whole piece of text. We successfully incorporate FGM and DeepFool into our framework. In addition, we empirically show that WMD is closely related to the quality of adversarial texts.

Motivation & Objective

• Address the challenge of applying gradient attacks to discrete text inputs.
• Develop a framework that operates in embedding space and reconstructs text via nearest neighbors.
• Quantify adversarial text quality with Word Mover's Distance (WMD).
• Demonstrate integration of gradient methods like FGM and DeepFool into the framework.
• Show that few-word changes can flip text labels in standard datasets.

Proposed method

• Search for adversarials in the embedding space to avoid discrete input issues.
• Reconstruct adversarial texts via nearest neighbor search to map embeddings back to words.
• Use Word Mover's Distance to quantify adversarial text quality.
• Incorporate gradient-based attacks such as FGM and DeepFool into the text framework.
• Evaluate on IMDB, Reuters-2, and Reuters-5 datasets to assess effectiveness.

Experimental results

Research questions

• RQ1 How can gradient-based adversarial attacks be adapted to the discrete text domain?
• RQ2 How effective are embedding-space adversarials when reconstructed into text?
• RQ3 What is the relationship between Word Mover's Distance and the perceptual quality of adversarial texts?
• RQ4 How many word changes are typically needed to alter text labels in standard datasets?

Key findings

• The framework can generate high-quality adversarial texts with only a few word changes.
• There are many cases where changing a single word flips the label of the text.
• WMD is closely related to the perceived quality of adversarial texts.
• FGM and DeepFool can be successfully incorporated into the framework.