Source-linked AI summary
Generating Natural Language Adversarial Examples on a Large Scale with Generative Models
Yankun Ren, Jianbin Lin, Siliang Tang, Jun Zhou, Shuang Yang, Yuan Qi, Xiang Ren
TL;DR
Pair-wise text attacks depend on existing labeled inputs, limiting the number and diversity of adversarial examples. This paper generates adversarial texts from scratch with a conditional VAE, adversarial loss, and discriminators. It reports higher attack success and faster generation than recent methods, with generated texts described as good quality and mostly valid.
Problem
Pair-wise text attacks require labeled inputs and produce limited numbers of adversarial examples that may lack diversity or readability.
Source: §1 · p. 1Method
A conditional VAE generates adversarial texts from scratch, guided by adversarial loss and GAN-trained discriminators that encourage similarity to real data.
Source: §1 · p. 1Results
The method achieves higher attack success rates and faster generation than recent methods, with generated texts described as good quality and mostly valid.
Source: §5 · p. 8Takeaways & Limitations
Generated adversarial texts can be used to substantially improve the robustness of text classification models.
Source: §4 · p. 5
Abstract
from arXiv · showhide
Today text classification models have been widely used. However, these classifiers are found to be easily fooled by adversarial examples. Fortunately, standard attacking methods generate adversarial texts in a pair-wise way, that is, an adversarial text can only be created from a real-world text by replacing a few words. In many applications, these texts are limited in numbers, therefore their corresponding adversarial examples are often not diverse enough and sometimes hard to read, thus can be easily detected by humans and cannot create chaos at a large scale. In this paper, we propose an end to end solution to efficiently generate adversarial texts from scratch using generative models, which are not restricted to perturbing the given texts. We call it unrestricted adversarial text generation. Specifically, we train a conditional variational autoencoder (VAE) with an additional adversarial loss to guide the generation of adversarial examples. Moreover, to improve the validity of adversarial texts, we utilize discrimators and the training framework of generative adversarial networks (GANs) to make adversarial texts consistent with real data. Experimental results on sentiment analysis demonstrate the scalability and efficiency of our method. It can attack text classification models with a higher success rate than existing methods, and provide acceptable quality for humans in the meantime.
1 Introduction
The paper proposes generating adversarial texts from scratch rather than modifying existing examples, addressing the limited scale of pair-wise attacks. Its conditional VAE-based system targets classifier predictions while using discriminators to encourage human-valid text, and experiments report scalable, fast generation with acceptable quality.
1 Introduction
- Pair-wise attacks modify an input while preserving its human-perceived class, but limited labeled data constrains their numbers and diversity, and examples may be hard to read and detectable.The paper argues this limits their ability to create large-scale impact.Source: §1 · p. 1
- The unrestricted method generates meaningful adversarial texts from scratch, without real-world inputs, and can scale beyond the limits of existing examples.The paper also proposes using generated examples for defense.Source: §1 · p. 1
- The authors also propose generated adversarial examples as defense data, noting that training with more adversarial examples often means greater robustness.Source: §1 · p. 1
- A conditional VAE generates texts of a desired class; adversarial loss targets the classifier, while GAN-trained discriminators encourage similarity to real data of that class.After training, the model can sample from the VAE latent space to generate examples without accessing the targeted model.Source: §1 · pp. 1–2
- Experiments on sentiment analysis report scalable generation, high attack success, fast parallel generation, and acceptable text quality.The paper also reports that data augmentation performs better than other methods when existing data is limited.Source: §1 · p. 2
2 Related Work
Prior text attacks adapt image-attack approaches to discrete words, typically replacing words in existing inputs. The paper instead proposes unrestricted generation that does not require given texts.
2 Related Work
- Image-attack research includes optimization-based and gradient-sign approaches, while much of the broader adversarial-machine-learning work focuses on image classification.The paper cites L-BFGS for [31] and FGSM for [10].Source: §2 · p. 2
- Text attacks often adapt pair-wise image methods because words are discrete, using gradients on word vectors to find replacement words.The cited gradient-based replacement methods are [9] [6].Source: §2 · p. 2
- Other text attacks replace words with typos or synonyms, but remain tied to given texts and substitutions can change meaning.The passage describes approaches in,, and.Source: §2 · p. 2
- The paper proposes generating diverse adversarial texts at scale without given texts, rather than transforming existing inputs.Its architecture also describes generating examples from sampled latent vectors and a chosen class without original texts.Source: §2 · p. 2, Figure 2 · p. 2
3 Methodology
The method trains a conditional VAE to generate adversarial texts that target a chosen classifier while class-specific discriminators encourage human-readable class consistency. After training, it can generate texts from latent samples without original inputs or further access to the targeted model.
3.1 Overview
- Training maps an input x to reconstructed x′, targets a wrong classifier label, and uses class-specific discriminators to align x′ with its intended human class.The targeted model supplies the adversarial objective, while each discriminator distinguishes real class data from generated examples.Source: §3.1 · pp. 2–3
3.2 Generator
- The GRU-based conditional VAE encodes inputs into latent codes and combines sampled codes with a desired-class embedding to generate text.KL regularization keeps posterior distributions close to a prior; KL annealing and word dropping encourage the decoder to use the latent code.Source: §3.2 · p. 3
3.3 Targeted Model
- For targeted attacks, the generator conditions on source class yk while cross-entropy encourages the targeted model to predict a different target class yt.Gumbel-Softmax approximates discrete word indices with continuous values so generated text can be passed to TextCNN.Source: §3.3 · p. 4
3.4 Discrimator Model
- One discriminator per class distinguishes real labeled texts from generated texts conditioned on that class, encouraging generated examples to resemble its data distribution.The authors expect this alignment to make generated texts more likely to be classified as the intended class by humans.Source: §3.1 · p. 3, §3.4 · p. 4
3.5 Model Training
- Training first fits the VAE and targeted model, then freezes the targeted model and jointly trains the generator and discriminators in a min-max game.The joint objective combines the VAE, adversarial, and discriminator losses.Source: §3.5 · p. 4
4 Experiments
Experiments on sentiment analysis evaluate both pair-wise attacks and unrestricted generation from scratch, reporting high attack success, acceptable text quality, and improved classifier robustness through adversarial-data augmentation.
4 Experiments
- Across the evaluated settings, pair-wise attacks are effective and efficient, while unrestricted generation produces diverse, mostly valid examples that can substantially improve text-classifier robustness.The experiments report higher pair-wise attack success than existing methods, fast generation, and adversarial training gains.Source: §4 · p. 5
4.1 Experiment Setup and Details
- Experiments use two public sentiment-analysis benchmarks: Rotten Tomatoes reviews and IMDB movie reviews.RT contains 5,331 positive and 5,331 negative reviews; IMDB contains 50,000 reviews.Source: §4.1 · p. 5
4.2 Comparing With Pair-wise Methods
- In pair-wise tests, the method exceeds TextBugger's attack success rate and generates faster than other methods after training, with each batch requiring one feed-forward.The comparison reports TextBugger as a state-of-the-art baseline; generation speed is attributed to training the generative model beforehand.Source: §4.2 · p. 5, Table 1 · p. 5, Table 2 · p. 5
4.3 Unrestricted Adversarial Text Generation
- Increasing φ raises attack success but also raises perplexity, while the vanilla VAE tends to generate neutral examples with lower target-model confidence.The authors attribute the attack-success increase to the greater role of Ladv in the joint loss.Source: §4.3 · pp. 6–7, Figure 5 · p. 6
- From-scratch generation yields more than 70% validity on both datasets, over 70% unique texts, and perplexity only slightly above the original data.On average, fewer than 18% of generated texts' 4-grams occur in the training data.Source: §4.3 · pp. 6–7, Figure 5 · p. 6
4.4 Ablation Study
- Removing discriminators leaves attack success close but substantially lowers validity; the min-max discriminator training helps control sentiment-word changes that humans reject.The described failure case changes a few words, such as adding “bad,” to flip the target prediction without fooling human readers.Source: §4.4 · p. 7, Table 3 · p. 7
4.5 Defense With Adversarial Training
- Adversarial-data augmentation keeps accuracy on original test data stable and improves accuracy on adversarial data from 0 to over 90%.The authors conclude that this improves robustness without hurting model effectiveness.Source: §4.5 · p. 7, Figure 7 · p. 7
- At similar adversarial test accuracy, unrestricted generation offers higher fluency than pair-wise augmentation, which requires more examples and higher φ when training data are limited.Higher φ is associated with bigger perplexity in pair-wise generation; unrestricted generation can provide infinite examples even with small φ.Source: §4.5 · pp. 7–8
5 Conclusion
The paper proposes a scalable method for generating adversarial texts from scratch, using adversarial loss and discriminators to guide and shape generation. Experiments report faster generation, higher attack success rates, and mostly valid, good-quality texts.
5 Conclusion
- The method generates adversarial texts from scratch to attack text classifiers, adding adversarial loss to mislead the target model.It uses discriminators and a GAN-like training strategy to make outputs mimic real data of the desired class.Source: §5 · p. 8
- After training, the generator can produce diverse adversarial examples of a desired class at large scale without real-world texts.Source: §5 · p. 8
- The method achieves higher attack success rates at higher speed than recent methods, while generated texts are mostly valid and of good quality.Source: §5 · p. 8
- Ablation experiments examine the effects of discriminators, while data-augmentation experiments find more diverse, higher-quality texts than pair-wise generation.The paper reports that this augmentation can make the targeted model more robust.Source: §5 · p. 8