Source-linked AI summary
BERT-ATTACK: Adversarial Attack Against BERT Using BERT
Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, Xipeng Qiu
TL;DR
Adversarial attacks on discrete text are difficult because heuristic replacements must balance model deception with fluency and semantic preservation. BERT-Attack uses a pretrained masked language model to generate contextual substitutions, and the paper reports stronger attacks with lower perturbation and query costs. The method is broadly effective but remains vulnerable to semantically unrelated or antonymous candidate substitutions and to sequence-length constraints.
Problem
Discrete text attacks must search replacement combinations while preserving language fluency and semantic consistency, whereas gradient-based methods are difficult to apply.
Method
BERT-Attack identifies vulnerable words and uses BERT’s masked-language-model predictions to generate contextual, semantic-preserving substitutes.
Results
BERT-Attack achieves higher attack success with lower perturbation percentages and fewer target-model accesses than previous attack algorithms.
Takeaways & Limitations
The method produces fluent and semantically preserved adversarial samples while requiring low calculation cost for large-scale generation.
Takeaways & Limitations
Masked-language-model candidates can be antonyms or irrelevant words, and contextual replacement is less reasonable for extremely short sequences.
Abstract
from arXiv · showhide
Adversarial attacks for discrete data (such as texts) have been proved significantly more challenging than continuous data (such as images) since it is difficult to generate adversarial samples with gradient-based methods. Current successful attack methods for texts usually adopt heuristic replacement strategies on the character or word level, which remains challenging to find the optimal solution in the massive space of possible combinations of replacements while preserving semantic consistency and language fluency. In this paper, we propose \textbf{BERT-Attack}, a high-quality and effective method to generate adversarial samples using pre-trained masked language models exemplified by BERT. We turn BERT against its fine-tuned models and other deep neural models in downstream tasks so that we can successfully mislead the target models to predict incorrectly. Our method outperforms state-of-the-art attack strategies in both success rate and perturb percentage, while the generated adversarial samples are fluent and semantically preserved. Also, the cost of calculation is low, thus possible for large-scale generations. The code is available at https://github.com/LinyangLee/BERT-Attack.
1 Introduction
Text adversarial attacks must mislead neural models while preserving human-perceived fluency and semantic consistency, but discrete inputs make this difficult. BERT-Attack uses BERT to identify vulnerable words and generate contextual, semantic-preserving substitutes, achieving strong attack results with limited perturbation and model access.
- Text attacks must produce imperceptible, fluent, and semantically consistent perturbations while misleading neural models.
- BERT’s pretrained language knowledge motivates using one BERT model to attack fine-tuned BERT models in downstream tasks.
- BERT-Attack uses BERT to generate adversarial samples through vulnerable-word identification followed by contextual substitution.Its perturbation generator uses masked-language-model predictions rather than repeated language-model scoring.
- The method generates fluent, semantically preserved adversarial samples that successfully mislead state-of-the-art NLP models.
- BERT-Attack reports higher attack success, lower perturbation, and fewer target-model accesses than previous algorithms without extra scoring models.
2 Related Work
Text adversarial attacks are difficult because language is discrete, and existing heuristic strategies struggle to balance attack effectiveness, fluency, semantic consistency, and generality across tasks.
- Gradient-based optimization is straightforward for continuous images but does not directly solve adversarial attacks on discrete text.
- Existing text attacks modify characters, replace words with synonyms, or use embedding-based perturbations and language-model scoring.
- Embedding-based substitutions are not strictly coordinated with semantic and grammatical constraints.
- Prior approaches leave room to improve perturbation percentage, attack success rate, grammatical correctness, and semantic consistency.
- Non-trivial substitution strategies limit some existing attacks to specific tasks.
3 BERT-Attack
BERT-Attack identifies the words most influential to a target model and replaces them with contextually generated, semantically consistent candidates. Its two-stage procedure uses BERT predictions and lightweight filtering to produce adversarial samples efficiently.
- 3.2 Word Replacement via BERT: The method iteratively replaces vulnerable words with candidates generated from BERT’s top-K predictions, stopping when the target model is fooled.BERT supplies contextualized predictions from the tokenized input, while candidates are filtered before replacement.
- 3.1 Finding Vulnerable Words: BERT-Attack first ranks words by their influence on the target model’s correct-label logit, then selects the most important words for perturbation.Importance is estimated by masking each word and measuring the resulting logit change; only a fraction of the highest-ranked words is retained to limit perturbations.
- 3.2 Word Replacement via BERT: Unlike earlier approaches that rely on multiple handcrafted constraints and repeated scoring, BERT-Attack uses contextualized substitutions intended to improve fluency and semantic preservation efficiently.The paper contrasts its approach with synonym dictionaries, part-of-speech checks, semantic-similarity checks, and repeated language-model scoring.
- 3.2 Word Replacement via BERT: BERT-Attack uses one masked-language-model inference pass rather than repeatedly scoring trial sentences with additional language models or linguistic checkers.This design reduces the computational cost of generating perturbations, leaving target-model access as the time-consuming component.
- 3.2.1 Word Replacement Strategy: For BPE-tokenized words, BERT-Attack combines sub-word predictions, converts combinations back into words, and ranks them using perplexity.The method handles single words and sub-words separately because rare words may span multiple BPE tokens.
- 3.2.1 Word Replacement Strategy: For single words, the procedure filters stop words and, in sentiment tasks, antonyms before selecting a candidate that preserves the attack objective.If a candidate already fools the target model, the procedure terminates; otherwise it chooses the best filtered perturbation and continues through the ranked list.
4 Experiments
Experiments evaluate BERT-Attack across text classification and natural language inference tasks using automatic and human-centered measures. The method successfully attacks fine-tuned BERT and other models while using low perturbation and preserving semantic and grammatical quality.
- Experimental Setup: Experiments cover text classification and natural language inference tasks, using 1k randomly selected test samples for each task.The datasets include Yelp, IMDB, AG’s News, FAKE, SNLI, and MNLI; the GA baseline uses only 50 FAKE and IMDB samples.
- Automatic Evaluation Metrics: The evaluation measures attack success rate, perturbed percentage, query number, and semantic consistency.Universal Sentence Encoder scores semantic consistency, while a similarity threshold filters less-similar examples.
- Attacking Results: BERT-Attack successfully fools fine-tuned BERT models in both text classification and natural language inference.The comparison uses TextFooler as the state-of-the-art baseline, with MNLI attacks applied separately to hypotheses or premises.
- Attacking Results: The average after-attack accuracy is lower than 10%, while the perturb percentage is less than 10%.The reported results indicate that most samples are successfully perturbed with fewer changes than previous works.
- Attacking Results: BERT-Attack successfully attacks all listed tasks and uses fewer queries and perturbations than strong baselines.The authors characterize it as more efficient and more imperceptible across diversified domains.
- Human Evaluations: Human evaluations find adversarial samples’ semantic and grammar scores close to those of original samples.Evaluations use IMDB and MNLI samples judged by three human annotators; MNLI label accuracy is lower because perturbations affect shared premise-hypothesis words.
- Attacking Other Models: BERT-Attack also succeeds against LSTM-based models, although ESIM is more robust on MNLI.The method is additionally reported to perform well against BERT-large models.
5 Ablations and Discussions
The ablations examine candidate selection, sequence length, transferability, adversarial training, sub-word attacks, importance ranking, runtime, and sample quality. Results show efficiency and attack quality depend on these design choices, while generated samples can remain semantically consistent.
- 5.1 Importance of Candidate Numbers: Increasing candidate number K raises attack rate, while semantic similarity drops by less than 2%.The candidate pool is the major hyperparameter, but the semantic measure remains stable as K increases.
- 5.1 Importance of Candidate Numbers: Thresholding unsuitable candidates lowers query numbers by skipping low-scoring masked-language-model predictions.The authors attribute the savings to avoiding candidates that may not be meaningful.
- 5.2 Importance of Sequence Length: BERT-Attack transfers across models in NLI, but transferability is lower in text classification.The analysis uses attacked accuracy, with attack-target models represented by columns and tested models by rows.
- 5.2 Importance of Sequence Length: Adversarial training makes the target model harder to attack while retaining accuracy close to training on clean datasets.Generated adversarial samples used for fine-tuning improve robustness without substantially changing accuracy.
- 5.4 Effects on Sub-Word Level Attack: Sub-word-level attacks achieve higher attack success rates and lower perturbation percentages than omitting multi-subword words.The comparison tests whether words tokenized into multiple subwords are included in the attack.
- 5.5 Importance Ranking: Word-importance ranking improves attack success compared with least-importance ranking.The ranking identifies words essential to neural-network predictions and targets those with greater risk of causing wrong predictions.
- 5.6 Runtime Comparison: BERT-Attack runs faster than previous methods because it avoids additional language-model or sentence-encoder scoring; it is reported as three times faster than TextFooler.The remaining time-consuming operation is accessing the target model.
- 5.7 Examples of Generated Adversarial Sentences: Generated adversarial samples preserve semantic consistency while causing incorrect target-model predictions in review classification and language inference examples.The examples report that perturbations do not mislead human judges.
6 Conclusion
BERT-Attack uses BERT’s masked language model to generate adversarial samples. It achieves high attack success with minimal perturbation, but generated candidates can sometimes be antonyms or irrelevant, causing semantic loss.
- BERT-Attack generates adversarial samples using the BERT masked language model.
- The method achieves a high success rate while maintaining minimum perturbation.
- Masked-language-model candidates can sometimes be antonyms or irrelevant, causing semantic loss.The paper identifies more semantically related perturbations as a possible future improvement.