HotFlip: White-Box Adversarial Examples for Text Classification

Abstract

We propose an efficient method to generate white-box adversarial examples to trick a character-level neural classifier. We find that only a few manipulations are needed to greatly decrease the accuracy. Our method relies on an atomic flip operation, which swaps one token for another, based on the gradients of the onehot input vectors. Due to efficiency of our method, we can perform adversarial training which makes the model more robust to attacks at test time. With the use of a few semantics-preserving constraints, we demonstrate that HotFlip can be adapted to attack a word-level classifier as well. Related WorkAdversarial examples are powerful tools to investigate the vulnerabilities of a deep learning model (Szegedy et al., 2014). While this line of research has recently received a lot of attention in

Adversarial Attacks and Defenses in Images, Graphs and Text: A Review

“…The work HotFlip (Ebrahimi et al, 2017) considers to replace a letter in a sentence in order to mislead a characterlevel text classifier (each letter is encoded to a vector). For example, as shown in Figure 11, changing a single letter in a sentence alters the model's prediction on its topic.…”

“…They try adding, removing or modifying the words and phrases in the sentences. In their approach, the first step is similar to HotFlip (Ebrahimi et al, 2017). For each training sample, they find the most-influential letters, called "hot characters".…”

“…Meanwhile, in other application domains involving graphs, text or audio, similar adversarial attacking schemes also exist to confuse deep learning models. For example, perturbing only a couple of edges can mislead graph neural networks (Zügner et al, 2018), and inserting typos to a sentence can fool text classification or dialogue systems (Ebrahimi et al, 2017). As a result, the existence of adversarial examples in all application fields has cautioned researchers against directly adopting DNNs in safety-critical machine learning tasks.…”

“…Replace one letter in a sentence to alter a text classifier's prediction on a sentence's topic. (Image Credit:(Ebrahimi et al, 2017)) …”

Learning to Discriminate Perturbations for Blocking Adversarial Attacks in Text Classification

“…For adversarial attacks, white-box attacks have full access to the target model while black-box attacks can only explore the models by observing the outputs with limited trials. Ebrahimi et al (2017) propose a gradient-based white-box model to attack character-level classifiers via an atomic flip operation. Small character-level transformations, such as swap, deletion, and insertion, are applied on critical tokens identified with a scoring strategy (Gao et al, 2018) or gradient-based computation (Liang et al, 2017).…”