[Paper Review] Discrete Adversarial Attacks and Submodular Optimization with Applications to Text Classification

Lei Qi, Lingfei Wu+4 more|arXiv (Cornell University)|Dec 1, 2018

Adversarial Robustness in Machine LearningComputer Science57 citations

TL;DR

The paper formulates discrete adversarial attacks on text as a set function optimization problem, proves submodularity for common NN text classifiers under certain conditions, and develops a gradient-guided greedy paraphrasing method with joint sentence and word replacements to improve attack effectiveness while preserving semantics.

ABSTRACT

Adversarial examples are carefully constructed modifications to an input that completely change the output of a classifier but are imperceptible to humans. Despite these successful attacks for continuous data (such as image and audio samples), generating adversarial examples for discrete structures such as text has proven significantly more challenging. In this paper we formulate the attacks with discrete input on a set function as an optimization task. We prove that this set function is submodular for some popular neural network text classifiers under simplifying assumption. This finding guarantees a $1-1/e$ approximation factor for attacks that use the greedy algorithm. Meanwhile, we show how to use the gradient of the attacked classifier to guide the greedy search. Empirical studies with our proposed optimization scheme show significantly improved attack ability and efficiency, on three different text classification tasks over various baselines. We also use a joint sentence and word paraphrasing technique to maintain the original semantics and syntax of the text. This is validated by a human subject evaluation in subjective metrics on the quality and semantic coherence of our generated adversarial text.

Motivation & Objective

• Motivate and formalize adversarial attacks on discrete text inputs as a set function optimization problem.
• Identify conditions under which the attack objective is submodular to enable efficient greedy approximations.
• Develop gradient-guided and paraphrase-based attack algorithms that preserve semantics.
• Empirically validate attack effectiveness on multiple text classification tasks and models.
• Offer a framework adaptable to other discrete domains beyond text (e.g., malware detection, spam filtering).

Proposed method

• Formulate the attack as maximizing C_y(V(T_l(x))) over a sparse set of feature transformations with ||l||_0 ≤ m.
• Define the set function f(S) = max_{supp(l)⊆S} C_y(V(T_l(x))) and show NP-hardness in general.
• Show that if f is monotone and submodular, a greedy algorithm achieves a (1-1/e) approximation.
• Demonstrate submodularity for two neural network classes: simplified Word CNN without dropout/softmax and RNN with one-dimensional hidden units under certain conditions.
• Introduce gradient-guided greedy word paraphrasing (Gauss-Southwell-inspired) to select high-impact words and efficiently search substitutions.
• Propose joint sentence and word paraphrasing with semantic (Word Mover Distance) and syntactic constraints to preserve meaning, using paraphrase corpora (Paragram-SL999 for words, Para-nmt-50m for sentences).
• Provide algorithms: Joint Sentence and Word Paraphrasing (Algorithm 1), Greedy Sentence Paraphrasing (Algorithm 2), Gradient-Guided Greedy Word Paraphrasing (Algorithm 3).

Experimental results

Research questions

• RQ1 Can discrete text attacks be cast as a set function optimization problem amenable to submodular optimization guarantees?
• RQ2 Under what conditions is the attack objective submodular for common text classifiers (e.g., WCNN, RNN)?
• RQ3 Does gradient-guided greedy search improve attack efficiency and effectiveness compared to existing baselines?
• RQ4 How can semantic-preserving paraphrasing be integrated into adversarial text generation without sacrificing attack success?
• RQ5 Do the proposed methods generalize across text classification tasks such as fake-news detection, spam filtering, and sentiment analysis?

Key findings

• For several text classifiers, the attack objective f is monotone and submodular under specified modeling assumptions, enabling a (1-1/e) approximation by greedy methods.
• Gradient-guided greedy word paraphrasing efficiently identifies high-impact word substitutions by prioritizing words with largest gradient norms.
• Joint sentence and word paraphrasing significantly improves attack success over word-only methods across datasets and models.
• Empirical results show higher adversarial success with the proposed methods compared to baselines on fake-news detection, spam filtering, and sentiment analysis tasks; results include substantial reductions in attack accuracy with fewer substitutions.
• A parity of results is demonstrated for WCNN and LSTM models across News, TREC07p, and Yelp datasets, with detailed comparisons to previous baselines.
• The authors provide open-source replication code for their attacks (online).