[Paper Review] BERT-ATTACK: Adversarial Attack Against BERT Using BERT

Linyang Li, Ruotian Ma+3 more|arXiv (Cornell University)|Apr 21, 2020

Adversarial Robustness in Machine LearningComputer Science26 references68 citations

TL;DR

BERT-ATTACK generates fluent, semantically preserved adversarial text by using a BERT masked language model to replace vulnerable words, achieving high attack success with low perturbation across multiple NLP tasks.

ABSTRACT

Adversarial attacks for discrete data (such as texts) have been proved significantly more challenging than continuous data (such as images) since it is difficult to generate adversarial samples with gradient-based methods. Current successful attack methods for texts usually adopt heuristic replacement strategies on the character or word level, which remains challenging to find the optimal solution in the massive space of possible combinations of replacements while preserving semantic consistency and language fluency. In this paper, we propose extbf{BERT-Attack}, a high-quality and effective method to generate adversarial samples using pre-trained masked language models exemplified by BERT. We turn BERT against its fine-tuned models and other deep neural models in downstream tasks so that we can successfully mislead the target models to predict incorrectly. Our method outperforms state-of-the-art attack strategies in both success rate and perturb percentage, while the generated adversarial samples are fluent and semantically preserved. Also, the cost of calculation is low, thus possible for large-scale generations. The code is available at https://github.com/LinyangLee/BERT-Attack.

Motivation & Objective

• Motivate robust evaluation of NLP models against adversarial text perturbations.
• Propose a high-quality attack that preserves fluency and semantics by leveraging a pre-trained language model (BERT).
• Demonstrate effectiveness across text classification and natural language inference tasks.
• Show efficiency and transferability of adversarial samples to other architectures.

Proposed method

• Two-stage framework: identify the most influential words and replace them with context-aware substitutes from a BERT masked language model.
• Compute word importance by masking each token and measuring the drop in the target model’s correct-logit to rank candidates.
• Replace chosen words using top-K predictions from BERT’s MLM, handling both whole words and sub-words via alignment with BERT’s BPE tokenization.
• For each candidate replacement, check if the target model’s prediction changes; stop when a successful attack is found.
• Use perplexity-based ranking for sub-word perturbations to ensure grammaticality and semantic coherence.
• Achieve perturbations with a single forward pass of the MLM, avoiding expensive scoring models.

Experimental results

Research questions

• RQ1 Can a pre-trained masked language model (BERT) be used to generate fluent, semantically preserved adversarial text that fools downstream NLP models?
• RQ2 How effective is the BERT-based perturbation strategy across diverse tasks (text classification and NLI) and models?
• RQ3 What are the trade-offs between attack success rate, perturbation magnitude, and fluency/semantics?
• RQ4 How transferable are BERT-Attack samples to other architectures and can adversarial data improve model robustness through adversarial training?

Key findings

• BERT-Attack achieves high attack success across multiple tasks, significantly lowering after-attack accuracy of fine-tuned models.
• Perturbation percentages remain under 10% on evaluated tasks, indicating strong semantic preservation.
• The method requires fewer queries and is faster than several baselines, due to avoiding repeated scoring models.
• Human evaluations show adversarial samples retain grammar and semantic integrity similar to originals.
• The attack transfers to other models (e.g., LSTM-based and BERT-Large targets), demonstrating cross-model effectiveness.
• Adversarial training with BERT-Attack samples can improve model robustness, with substantial but variable gains depending on task.