Abstract:

Aiming at the problem that the existing adversarial example generation methods require a lot of queries to the target model， which leads to poor attack effects， a Text Adversarial Examples Generation Method based on BERT （Bidirectional Encoder Representations from Transformers） model （TAEGM） was proposed. Firstly， the attention mechanism was adopted to locate the keywords that significantly influence the classification results without query of the target model. Secondly， word-level perturbation of keywords was performed by BERT model to generate candidate adversarial examples. Finally， the candidate examples were clustered， and the adversarial examples were selected from the clusters that have more influence on the classification results. Experimental results on Yelp Reviews， AG News， and IMDB Review datasets show that compared to the suboptimal adversarial example generation method CLARE （ContextuaLized AdversaRial Example generation model） on Success Rate （SR）， TAEGM can reduce the Query Counts （QC） to the target model by 62.3% and time consumption by 68.6% averagely while ensuring the SR of adversarial attacks. Based on the above， further experimental results verify that the adversarial examples generated by TAEGM not only have good transferability， but also improve the robustness of the model through adversarial training.

Key words: adversarial example, attention mechanism, BERT (Bidirectional Encoder Representations from Transformers), adversarial attack, clustering algorithm

摘要：

针对现有对抗样本生成方法需要大量访问目标模型，导致攻击效果较差的问题，提出了基于BERT （Bidirectional Encoder Representations from Transformers）模型的文本对抗样本生成方法（TAEGM）。首先采用注意力机制，在不访问目标模型的情况下，定位显著影响分类结果的关键单词；其次通过BERT模型对关键单词进行单词级扰动，从而生成候选样本；最后对候选样本进行聚类，并从对分类结果影响更大的簇中选择对抗样本。在Yelp Reviews、AG News和IMDB Review数据集上的实验结果表明，相较于攻击成功率（SR）次优的对抗样本生成方法CLARE（ContextuaLized AdversaRial Example generation model），TAEGM在保证对抗攻击SR的前提下，对目标模型的访问次数（QC）平均减少了62.3%，时间平均减少了68.6%。在此基础之上，进一步的实验结果验证了TAEGM生成的对抗样本不仅具有很好的迁移性，还可以通过对抗训练提升模型的鲁棒性。

关键词: 对抗样本, 注意力机制, BERT, 对抗攻击, 聚类算法