On Adversarial Examples for Character-Level Neural Machine Translation

Abstract

Evaluating on adversarial examples has become a standard procedure to measure robustness of deep learning models. Due to the difficulty of creating white-box adversarial examples for discrete text input, most analyses of the robustness of NLP models have been done through blackbox adversarial examples. We investigate adversarial examples for character-level neural machine translation (NMT), and contrast black-box adversaries with a novel white-box adversary, which employs differentiable string-edit operations to rank adversarial changes. We propose two novel types of attacks which aim to remove or change a word in a translation, rather than simply break the NMT. We demonstrate that white-box adversarial examples are significantly stronger than their black-box counterparts in different attack scenarios, which show more serious vulnerabilities than previously known. In addition, after performing adversarial training, which takes only 3 times longer than regular training, we can improve the model's robustness significantly.

Repairing Adversarial Texts through Perturbation

“…This work is related to work on adversarial attacks in the text domain, which can be roughly divided into the following categories. One category is adversarial misspelling, which tries to evade the classifier by some "human-imperceptible" misspelling on certain selected characters [14], [17], [67]. The core idea is to design a strategy to identify the important positions and afterwards some standard character-level operations like insertion, deletion, substitution and swap can be applied.…”

Adversarial Attacks and Defenses for Social Network Text Processing Applications: Techniques, Challenges and Future Research Directions

“…Typically, a target word is replaced by an equivalent one chosen from a space of possible replacements. Such a space was identified by Ebrahimi et al [83] and referred to as the embedding space. In [83], the authors consider neural machine translation (NMT) and propose elementary modifications to achieve word-level adversarial attacks.…”

“…Such a space was identified by Ebrahimi et al [83] and referred to as the embedding space. In [83], the authors consider neural machine translation (NMT) and propose elementary modifications to achieve word-level adversarial attacks. In this regard, the authors extend the HotFLip algorithm proposed in [56] adding, removing, or replacing a word in the translation input.…”

“…Another subcategory of works on optimizing adversarial word-level attacks is concerned with improving the search for word replacements in an embedding space. In the current literature, there are three main categories of text replacement techniques: (i) gradientbased [83,8,80], (ii) sampling-based [34,75], and (iii) enumeration based [59,84,74], as shown in Fig. 4.…”

A Reinforced Generation of Adversarial Examples for Neural Machine Translation

“…Instead of designing error features, recent researchers adopt ideas from adversarial learning (Goodfellow, Shlens, and Szegedy, 2014) to generate adversarial samples to mine NLP system pitfalls (Cheng et al, 2018a;Ebrahimi, Lowd, and Dou, 2018;Zhao, Dua, and Singh, 2017). Adversarial samples are minor perturbed inputs which keep the semantic meaning of the input, yet yield degraded outputs.…”