On the Transferability of Adversarial Attacksagainst Neural Text Classifier

1 Introduction

• The study systematically investigates how model factors affect black-box transferability, where examples crafted against one model fool another.The examined factors include architecture, tokenization, embedding type, and model capacity.Source: §1 · p. 1
• Tokenization scheme has the greatest influence on transferability, followed by network architecture, embedding type, and model capacity across two text-classification datasets.The study varies one factor at a time while fixing the others.Source: §1 · p. 2
• Adversarial examples generated by an ensemble are more transferable, and a genetic algorithm selects an ensemble using empirical transferability between models.The examples crafted by attacking the selected ensemble strongly transfer to other models.Source: §1 · p. 2
• The authors derive semantics-preserving word-replacement rules from ensemble examples to identify dataset biases and diagnose model heuristics without access to the victim model.The rules are model-agnostic and can induce adversaries on text inputs that transfer to other neural models.Source: §1 · p. 2

2.1 Experimental Design

• The experiments vary one factor at a time while fixing the others, generating examples with a source model and testing them on other models.The model pool contains 63 models, and attacks are evaluated on MR and AGNEWS using PWWS and GA.Source: §2 · p. 2, §2.1 · pp. 2–3

2.2 Significance of Various Factors

• After adjusting for base transferability, tokenization has the greatest influence, followed by architecture, embedding type, and model capacity.The adjusted rates are averaged over model configurations; smaller values are closer to the base intra-model transferability rate.Source: §2.2 · pp. 3–4

2.3 Intra-Factor Transferability

• Transfer is asymmetric, and intra-model adversarial examples transfer more than inter-model examples; BERT examples transfer slightly worse, while BERT models are more robust to examples from other classes.The authors suggest that BERT's pretraining and subword tokenization may contribute to this pattern; character-based models are more robust, but their examples transfer less.Source: §2.3 · p. 4

2.4 Summary of Findings

• Tokenization has the greatest impact on transferability, followed by architecture, embedding type, and model capacity, regardless of attack algorithm or dataset.The study also reports asymmetric transfer, stronger intra-model than inter-model transfer, and greater robustness for pre-trained models.Source: §2.4 · p. 4
• Small ensembles produce more transferable examples than a single model, and the findings suggest including at least one model per tokenization scheme in a representative pool.The authors note that including fewer models reduces the cost of estimating pairwise transferability.Source: §2.4 · pp. 4–5

3.1 Ensemble Method

• The genetic algorithm evolves fixed-size model sets using empirical transferability to evaluate candidates, with selection, recombination, and mutation.Its transferability measure counts adversarial samples from one model that another model misclassifies under an attack algorithm.Source: §3.1 · p. 5
• Ensembles outperform single-model transfer, and genetic-algorithm ensembles usually beat human-selected ones, especially at small sizes; gains diminish above six models.In some cases, ensemble transferability exceeds the stated single-model ceiling.Source: Figure 2 · p. 6, §3.1 · p. 6

3.2 Mining Word Replacement Rules

• HAWR rules are class-conditioned word substitutions ranked by salience and applied iteratively, allowing attacks without access to target models.The six-model ensemble found by the genetic algorithm supplied the rules; their attacks were comparable to query-intensive PWWS and GA attacks.Source: §3.2 · pp. 6–7
• HAWR rules transfer more strongly than PMI-derived rules; the authors attribute this to logits reflecting both neural-network characteristics and replacement contexts.The PMI differences between original words and their synonyms also demonstrate training-data bias, according to the paper.Source: §3.2 · p. 7

3.3 Case Study: Natural Language Inference

• On SNLI, HAWR rules tested on three models unseen during rule discovery performed comparably to TextFooler, which requires many victim-model queries.The rules were derived using a six-model ensemble selected from a pool of 63 models.Source: §3.3 · p. 7

Transfer-based Attacks

• Transfer-based attacks use white-box attacks on local surrogate models, but can overfit their weaknesses and achieve lower success than direct target attacks.Proposed improvements include perturbing intermediate activations, adding regularization, and ensembling local models.Source: §4 · pp. 7–8
• Prior ensemble-transfer studies were mainly in image domains, leaving transfer-based attacks for NLP models relatively underexplored.Related approaches hypothesized that examples adversarial for multiple models are likelier to transfer; another method used locally averaged gradients to reduce loss-surface oscillation.Source: §4 · p. 8

Discovering Adversarial Word Replacement Rules

• Ribeiro et al. (2018) generalized paraphrase perturbations into universal replacement rules for selected models; this paper instead seeks rules that fool almost all models.The earlier work’s rule set was relatively small compared with this paper’s.Source: §4 · p. 8

5 Conclusion

• The study examines how architecture, tokenization, embedding type, and model capacity affect adversarial-example transferability across more than sixty neural models.Source: §5 · p. 8
• A genetic algorithm selects a very small ensemble whose adversarial examples transfer well to other models.Source: §5 · p. 8
• The authors derive highly transferable word-replacement rules that can craft adversarial examples without access to target models and help identify dataset biases.Source: §5 · p. 9

A.1 All Neural Models under Investigation

• The investigated architectures include LSTM, BiLSTM, CNN, and BERT models.Source: §A.1 · p. 11
• Tokenization configurations include word, character, and combined word-plus-character schemes.Source: §A.1 · p. 11
• Embedding configurations use random initialization, GloVe, word2vec, or fastText, while model capacity varies by layer count.Source: §A.1 · p. 11
• The authors state that the investigated models cover popular neural networks used for NLP text classification.Source: §A.1 · p. 11, Table 8 · p. 11

A.2 Transferability among Different Neural Models

• The figure's rows and columns identify target and source model IDs, respectively.Source: §A.2 · p. 11
• Rates are measured by attacking a source model and evaluating transfer on a target, or victim, model.Source: §A.2 · p. 11
• Figure 4 presents transferability among neural models across its two parts.Source: Figure 4 · pp. 11–12, §A.2 · p. 11

A.3 Heatmap of Word Importance

• Original-word importance is the gold-label log-likelihood difference before and after replacement with <unk>; substitute-word importance compares the gold-label likelihood before and after substitution.Source: §A.3 · p. 13
• The heatmaps use a one-hidden-layer model subset and the example sentence beginning “Storage, servers bruise HP earnings update”.Source: §A.3 · p. 13
• For original words, most models focus mainly on “Storage”, “servers”, and “HP”; for substitutes, most focus on “depot”.Source: §A.3 · p. 13, Figure 7 · p. 13
• The authors say the similar word-focus patterns make it possible to generate adversarial examples with one model that transfer strongly to others.Source: §A.3 · p. 13
• BERT-family and character-based models distribute attention differently, which the authors say explains their lower adversarial-transfer rates.Source: §A.3 · p. 13

• Table 9 lists ensemble models selected by the genetic algorithm and human experts for AGNEWS and MR.Source: §A.4 · p. 14

• Table 10 lists ensemble models selected by the genetic algorithm for SNLI.Source: §A.5 · p. 14