Source-linked AI summary
BAE: BERT-based Adversarial Examples for Text Classification
Siddhant Garg, Goutham Ramakrishnan
TL;DR
Text adversarial attacks must induce misclassification while preserving semantic coherence, but synonym-based methods can generate unnatural, out-of-context replacements. BAE uses contextual BERT-MLM masking to replace or insert tokens in a soft-label black-box attack. Automatic and human evaluations show stronger attacks with improved grammaticality and semantic coherence, while the method’s scope includes potential misuse against public classifiers.
Problem
NLP adversarial-example generation must preserve semantic coherence in a discrete token space, while synonym-based strategies can produce out-of-context and unnaturally complex replacements.
Method
BAE generates black-box adversarial examples by masking text and using BERT-MLM to propose contextual token replacements and insertions.
Results
Automatic and human evaluations show stronger attacks with improved grammaticality and semantic coherence compared with prior baselines.
Takeaways & Limitations
BAE provides a contextual perturbation technique for analyzing the robustness of modern text classification models.
Takeaways & Limitations
The authors acknowledge that BAE can be misused to maliciously attack publicly available text classifiers.
Abstract
from arXiv · showhide
Modern text classification models are susceptible to adversarial examples, perturbed versions of the original text indiscernible by humans which get misclassified by the model. Recent works in NLP use rule-based synonym replacement strategies to generate adversarial examples. These strategies can lead to out-of-context and unnaturally complex token replacements, which are easily identifiable by humans. We present BAE, a black box attack for generating adversarial examples using contextual perturbations from a BERT masked language model. BAE replaces and inserts tokens in the original text by masking a portion of the text and leveraging the BERT-MLM to generate alternatives for the masked tokens. Through automatic and human evaluations, we show that BAE performs a stronger attack, in addition to generating adversarial examples with improved grammaticality and semantic coherence as compared to prior work.
1 Introduction
BAE addresses the difficulty of generating semantically coherent adversarial text by using contextual BERT-MLM perturbations that replace or insert tokens. Across multiple datasets and models, it produces stronger attacks with improved grammaticality and semantic coherence.
- Motivation: NLP adversarial-example generation must handle discrete tokens while preserving semantic coherence with the original text.These constraints make direct adaptation of continuous-space attack methods difficult.
- Motivation: Rule-based synonym replacement can produce out-of-context and unnaturally complex substitutions that humans easily identify.Token-level similarity does not necessarily preserve overall sentence semantics.
- BAE: BAE uses a BERT masked language model to replace words and insert new tokens based on the surrounding context.Perturbations are generated by masking part of the input and filling the mask with a language model.
- Results: BAE reduces the accuracy of even a powerful BERT classifier by over 80% on some datasets using only a few replace/insert operations.Empirical evaluation spans multiple datasets and models.
- Results: Human evaluation shows that BAE adversarial examples have improved grammaticality and semantic coherence compared with prior attacks.The paper attributes improved grammaticality to the BERT-MLM.
2 Methodology
BAE is a soft-label black-box attack that ranks important tokens, generates contextual replacements or insertions with BERT-MLM, filters candidates for similarity and part-of-speech consistency, and iteratively seeks misclassification.
- Problem Definition: In the soft-label black-box setting, the attacker queries output probabilities but lacks model parameters, gradients, and training data.The goal is an adversarial example misclassified by the classifier while remaining grammatical and semantically similar.
- Perturbation Operations: BAE perturbs text through two operations: replacing a token or inserting a new token adjacent to it.The attack offers four modes based on replacement, insertion, or their combinations.
- Token Selection: Token importance is estimated by deleting each token and measuring the decrease in the classifier’s probability of the correct label.Perturbations are applied in decreasing token-importance order.
- Candidate Generation: BERT-MLM predicts masked tokens for replacement or insertion, using contextual information to fit the grammar and context of the text.The language model was trained on approximately 2 billion words.
- Candidate Filtering: Top-K BERT-MLM candidates are filtered with Universal Sentence Encoder similarity, while replacement candidates must also match the original token’s part of speech.This filtering addresses cases where grammatical predictions change the original sentiment or meaning.
- Attack Procedure: Candidates that cause misclassification are selected by maximum similarity; otherwise, the candidate causing the largest reduction in correct-label probability is chosen.The process continues until the attack succeeds or all tokens have been perturbed.
3 Experiments
BAE is evaluated across multiple text-classification datasets and models against TextFooler using automatic, semantic-similarity, effectiveness, qualitative, and human evaluations. Across these evaluations, BAE generally produces stronger attacks and more natural adversarial examples, while replace/insert flexibility contributes to attack success.
- Datasets and Models: BAE is evaluated on multiple text-classification datasets, including sentiment, opinion, subjectivity, and question-type tasks, using word-LSTM, word-CNN, and fine-tuned BERT classifiers.Attacks are performed on test data, with TextFooler as the synonym-replacement baseline.
- Automatic Evaluation: 40-80% drops in test accuracy are achieved across datasets and models, with BAE attacks almost always more effective than the baseline and higher average semantic similarities.The automatic evaluation summarizes results across Tables 1 and 2.
- Automatic Evaluation: BAE-R+I is strongest with one exception, while BAE-R/I and BAE-R+I generally outperform the individual replace or insert modes.The BERT classifier is more robust to both BAE and TextFooler than the word-LSTM and word-CNN models.
- Effectiveness: On TREC, BAE attacks are consistently stronger than TextFooler; effectiveness is relatively limited up to 20% perturbation and saturates at 40-50%.A 50% perturbation corresponds to replacing or inserting only 3-4 words because TREC texts are short.
- Qualitative Examples: BAE-generated examples use contextual tokens that fit the sentence, whereas TextFooler often produces complex synonyms that are easily detected by humans.Table 3 provides qualitative examples on IMDB and Yelp sentences.
- Human Evaluation: Human evaluation finds BAE-R and BAE-R+I almost always outperform TextFooler on sentiment accuracy and naturalness, although insertion can trade off naturalness and sentiment accuracy.The evaluation uses three annotators and includes successful adversarial examples from BAE-R, BAE-R+I, and TextFooler.
- Replace vs. Insert: The replace/insert analysis shows that insertion is important, with some test instances requiring insertion alone and others requiring both operations for successful attacks.The split requiring both operations is largest for Subj, the dataset described as most robust to attack.
4 Conclusion
The paper presents BAE, which generates adversarial examples through contextual perturbations from BERT's masked language model. It combines token insertion and replacement, with automatic and human evaluations demonstrating attack strength and effectiveness.
- BAE generates adversarial examples through contextual perturbations based on the BERT masked language model.
- The method inserts and/or replaces tokens according to their importance for the text classification task.
- The paper reports automatic and human evaluations across several datasets demonstrating BAE's strength and effectiveness.
Broader Ethical Impact
The paper studies adversarial vulnerabilities in modern text classification models while acknowledging that the technique could be misused against publicly available classifiers. It frames the work as supporting robustness analysis and improved defenses.
- The work addresses adversarial vulnerabilities in modern text classification models.
- The authors acknowledge that the technique could be misused to maliciously attack publicly available text classifiers.
- The authors position the work as analyzing NLP model robustness and inspiring improved defenses against text-classification attacks.
A Experimental Reproducibility
The experiments use seven text-classification datasets and three model families, including WordCNN, word-LSTM, and fine-tuned BERT. Implementation details specify model architectures, training settings, and BAE filtering procedures.
- Datasets: The evaluation covers Amazon, Yelp, IMDB, MR, MPQA, TREC, and SUBJ text-classification datasets.
- Training details: WordCNN uses 100 filters of sizes 3, 4, and 5 with dropout 0.3, while the bi-directional LSTM has 150 hidden units and dropout 0.3.
- Training details: The BERT base uncased classifier has 12 layers, 12 attention heads, and a 768-dimensional hidden size.
- Attack configuration: BAE uses a pretrained BERT base-uncased masked language model, considers the top K=50 predictions, and applies a USE cosine-similarity threshold of 0.8.
- Attack configuration: Replacement operations filter predicted tokens by part of speech, stop-word status, and, for sentiment tasks, antonymy.
B Results
Figures 3–8 provide the complete set of graphs for attack effectiveness across all seven datasets. The section therefore presents dataset-wide graphical results rather than a single dataset view.
- Figures 3–8 comprise the complete set of graphs showing attack effectiveness for all seven datasets.
- The reported graphical results span all seven datasets rather than a single evaluation dataset.
- The figures are intended to visualize attack effectiveness across the paper's full dataset set.
C Human Evaluation
Human evaluators judged whether adversarial texts appeared natural based on grammar and similarity to the original dataset. BAE-R outperformed TextFooler on sentiment accuracy and naturalness scores.
- Human evaluators judged whether texts appeared adversarial based on grammar and their likelihood of coming from the original dataset.Naturalness was evaluated through human judgments.
- Examples were rated on a 1-5 Likert scale ranging from sure adversarial sample to sure original sample.
- BAE-R always beats TextFooler on sentiment accuracy and naturalness score.The authors attribute TextFooler’s lower naturalness to unnaturally long and complex synonym replacements.