[Paper Review] HotFlip: White-Box Adversarial Examples for Text Classification

Javid Ebrahimi, Anyi Rao+2 more|arXiv (Cornell University)|Dec 19, 2017

Adversarial Robustness in Machine LearningComputer Science21 references81 citations

TL;DR

The paper presents HotFlip, a gradient-based white-box method to generate character-level adversarial text by single-token flips, enabling efficient adversarial training to improve robustness of text classifiers.

ABSTRACT

We propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier. We find that only a few manipulations are needed to greatly decrease the accuracy. Our method relies on an atomic flip operation, which swaps one token for another, based on the gradients of the one-hot input vectors. Due to efficiency of our method, we can perform adversarial training which makes the model more robust to attacks at test time. With the use of a few semantics-preserving constraints, we demonstrate that HotFlip can be adapted to attack a word-level classifier as well.

Motivation & Objective

• Motivate investigation of vulnerabilities in character-level NLP models using white-box adversaries.
• Propose an efficient gradient-based method to manipulate discrete text through one-hot input representations.
• Show that adversarial training with HotFlip improves robustness and can extend to word-level classifiers with constraints.

Proposed method

• Define an atomic flip operation that substitutes one character for another based on directional derivatives of the loss with respect to the one-hot input.
• Use a first-order (gradient) approximation to estimate the best single change as max over (dJ/dx^(b) − dJ/dx^(a)).
• Extend to sequences of changes with greedy/beam search, incurring O(br) forward and backward passes for r changes and beam width b.
• Normalize change vectors by their L2 norm to account for differing magnitudes of flips.
• Adapt insertion and deletion as sequences of flips; for efficiency, primarily employ flips in adversarial training.
• Demonstrate applicability to word-level models under semantics-preserving constraints when necessary.

Experimental results

Research questions

• RQ1 How vulnerable are differentiable character-level text classifiers to targeted, gradient-based perturbations?
• RQ2 Can a fast, white-box adversary produce realistic adversarial text with small edits and high misclassification rates?
• RQ3 Does adversarial training with HotFlip-Generated examples improve robustness to attacks and maintain accuracy on clean data?
• RQ4 Can HotFlip be adapted to word-level models while preserving meaning under semantic constraints?

Key findings

• White-box adversaries achieve high misclassification with small edits under a character-budget (e.g., 10% of characters).
• Beam search with HotFlip can fool the classifier for more than 90% of instances at a given confidence constraint on 10% of the test set.
• Adversarial training with HotFlip reduces misclassification error and lowers the adversary’s success rate more effectively than embedding-noise adversarial training or black-box attacks.
• The average adversarial flip rate observed is 4.18% of characters when targeting confidence 0.5.
• Adversarial training using real HotFlip examples yields better robustness than training on pseudo-adversarial embedding perturbations (Miyato et al. 2017).
• Human evaluation indicates that HotFlip adversarial edits rarely alter sentence meaning; average human accuracy drops only modestly.