Source-linked AI summary
Gradient-based Adversarial Attacks against Text Transformers
Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, Douwe Kiela
TL;DR
Text adversarial attacks lack a general gradient-based approach because text is discrete and its perceptibility constraints are difficult to define. GBDA optimizes a Gumbel-softmax parameterized distribution with differentiable fluency and semantic constraints, achieving state-of-the-art performance across tasks and enabling transfer attacks using only hard-label outputs.
Problem
Text attacks lack a general gradient-based optimization approach because language is discrete and perceptibility constraints are difficult to define.
Method
GBDA optimizes a continuous matrix parameterizing a Gumbel-softmax adversarial distribution, with differentiable perplexity and BERTScore soft constraints.
Results
Across several natural language tasks and transformer architectures, GBDA achieves state-of-the-art attack performance in white-box and black-box transfer settings.
Takeaways & Limitations
Sampling the optimized adversarial distribution enables transfer attacks against potentially unknown target models using only hard-label outputs.
Takeaways & Limitations
The method is restricted to token replacements, and its Gumbel-softmax adversarial distribution does not trivially extend beyond that setting.
Abstract
from arXiv · showhide
We propose the first general-purpose gradient-based attack against transformer models. Instead of searching for a single adversarial example, we search for a distribution of adversarial examples parameterized by a continuous-valued matrix, hence enabling gradient-based optimization. We empirically demonstrate that our white-box attack attains state-of-the-art attack performance on a variety of natural language tasks. Furthermore, we show that a powerful black-box transfer attack, enabled by sampling from the adversarial distribution, matches or exceeds existing methods, while only requiring hard-label outputs.
1 Introduction
Text attacks are difficult to optimize with gradients because natural language is discrete and lacks straightforward perceptibility metrics. GBDA addresses these challenges by optimizing a differentiable adversarial distribution with fluency and semantic constraints, achieving strong white-box and transfer performance.
- Motivation: Text attacks are difficult to optimize with gradients because language is discrete and standard L2- and L∞-based perceptibility metrics do not readily apply.Prior methods therefore rely on black-box heuristic search, which can introduce grammatically or semantically incorrect changes.
- Method: GBDA optimizes a parameterized distribution of adversarial examples rather than a single example, using a continuous coefficient matrix and Gumbel-softmax sampling.This formulation enables gradient-based optimization for discrete text inputs.
- Method: Differentiable BERTScore and language-model perplexity constraints promote semantic similarity, fluency, and grammatical correctness during optimization.The constraints are added softly to the adversarial objective.
- Method: GBDA operates at the token level while handling token-combination fluency directly through a language-model constraint, avoiding some prior search-space and ordering issues.This makes the method generic and potentially applicable to models for text sequence prediction.
- Results: Across news categorization, sentiment analysis, and natural language inference, GBDA achieves state-of-the-art attack success while preserving fluency, grammatical correctness, and semantic similarity.The framework is evaluated in both white-box and transfer-based black-box settings.
- Results: The transfer attack samples from the optimized adversarial distribution and requires only hard-label outputs from the target model.It matches or exceeds existing black-box attack performance according to the paper’s contribution summary.
2 Background
Adversarial examples seek inputs that change a model’s prediction while remaining imperceptibly close to the original for humans. Text attacks face discrete inputs and difficult perceptibility constraints, motivating heuristic methods but leaving a gap in fluent, effective optimization.
- Adversarial examples: An untargeted adversarial example changes a correctly predicted input x into x′ such that h(x′) ≠ h(x) while preserving imperceptible closeness.Perceptibility is intended to preserve the original input’s semantic meaning for human observers.
- Search formulation: For classification, adversarial search commonly minimizes a loss derived from the model’s logits, optionally combining it with a soft perceptibility constraint.Gradient-based optimization requires the constraint function to be differentiable.
- Text adversarial examples: The continuous-data formulation does not directly transfer to text because the input space is discrete and text perceptibility is difficult to define.A single token edit, such as inserting “not,” can substantially change sentence meaning.
- Prior work: Prior text attacks use character edits, synonym substitutions, and other heuristic replacements to approximate perceptibility and search over discrete inputs.These approaches include black-box query strategies such as greedy or beam search.
- Shortcomings: Prior attacks often produce detectable artifacts, including misspellings and grammatical errors, and their zeroth-order black-box optimization can yield sub-optimal performance.The cited discussion identifies naturalness and optimization efficiency as persistent shortcomings.
- Results: 94.2 to 2.5: the paper reports reducing BERT accuracy on AG News, compared with 94.2 to 10.6 for BERT-Attack.The paper also states that its result is more semantically faithful to the original text.
3 GBDA: Gradient-based Distributional Attack
GBDA replaces discrete single-example search with gradient optimization over a parameterized adversarial distribution. It combines Gumbel-softmax relaxation with differentiable fluency and semantic-similarity constraints, then samples adversarial texts for white-box and transfer attacks.
- 3.1 Adversarial Distribution: GBDA parameterizes a distribution over token sequences with a continuous matrix Θ, enabling gradient-based optimization instead of constructing one adversarial example.The distribution independently samples tokens, while each token’s probabilities are represented by a row of Θ.
- 3.1 Adversarial Distribution: Gumbel-softmax supplies a differentiable relaxation by extending transformer inputs from discrete tokens to probability vectors.The temperature T controls smoothness, and the distribution approaches the categorical distribution as T approaches zero.
- 3.1 Adversarial Distribution: The framework embeds probability vectors by weighted combinations of token embeddings, recovering the original token embedding for one-hot vectors.Sequence embeddings are formed by concatenating the resulting per-position embeddings.
- 3.2 Soft Constraints: GBDA incorporates differentiable fluency and semantic-similarity constraints through language-model negative log-likelihood and BERTScore-based objectives.The soft-constraint strengths are controlled by λ_lm and λ_sim, and optimization uses Adam with sampled batches.
- 3.3 Sampling Adversarial Texts: After optimizing Θ, the method samples repeatedly from P_Θ until a sample is misclassified or the maximum sample count is reached.Because the optimized loss approximates the discrete objective, individual samples may remain non-adversarial.
- 3.3 Sampling Adversarial Texts: Sampling from P_Θ also enables black-box transfer attacks against different target models without requiring continuous-valued target scores.The framework evaluates this setting across a variety of target models and reports effective attacks.
4 Experiments
Experiments evaluate GBDA across multiple text-classification datasets, transformer architectures, white-box and transfer black-box settings. The attack substantially reduces accuracy while preserving semantic similarity, and analyses examine transferability, fluency, tokenization, and runtime trade-offs.
- Experimental setup: Experiments cover article categorization, sentiment classification, and natural language inference using DBPedia, AG News, Yelp Reviews, IMDB, and MNLI.The MNLI evaluation includes matched and mismatched test domains.
- Experimental setup: The study attacks GPT-2, XLM, and BERT with GBDA and compares against TextFooler, BAE, and BERT-Attack on finetuned BERT classifiers.Baseline attacks require black-box query access, enabling comparison with both GBDA’s white-box and GPT-2-to-BERT transfer settings.
- White-box attacks: White-box attacks reduce test accuracy below 10% for almost all models and tasks while maintaining cosine semantic similarity higher than 0.8 in most cases.For each target, the method optimizes Θ and samples up to 100 adversarial examples until misclassification.
- Transfer attacks: Transfer attacks reduce target BERT accuracy to close to BERT-Attack or better within fewer queries in almost all settings, with higher cosine similarity than BERT-Attack.The transfer attack optimizes PΘ on GPT-2 and samples against the target BERT model.
- Analysis: The similarity constraint creates a trade-off: higher λsim makes perturbations less aggressive but increases queries, while the fluency constraint promotes valid words and grammatical text.Without fluency regularization, adversarial texts tend to contain nonsensical words; lower λsim generalizes better to different target models.
- Limitations and runtime: Tokenization artifacts occur around 2% of the time, and the method requires forward and backward passes through the attacked, language, and similarity models.Despite the extra per-query cost, total runtime is 20s per generated example, on par with BERT-Attack; reported adversarial accuracy is computed after re-tokenization.
5 Conclusion and Future Work
GBDA uses a parameterized adversarial distribution to enable gradient-based attacks against text transformers, achieving strong attack performance while exposing limitations in token-edit scope and parameterization.
- Conclusion: GBDA searches a parameterized adversarial distribution rather than a single adversarial example, enabling efficient gradient-based optimization and differentiable constraints.The method incorporates constraints such as perplexity and BERTScore.
- Conclusion: GBDA attains state-of-the-art attack performance across varied natural language tasks and transformer architectures in white-box and black-box transfer settings.
- Limitations: GBDA is restricted to token replacements because its Gumbel-softmax adversarial distribution does not trivially extend to token insertions and deletions.The authors suggest extending the framework to broader token-level changes.
- Conclusion: Without the fluency constraint, generated AG News adversarial texts contain more nonsensical token combinations.
- Limitations: The adversarial distribution is highly over-parameterized, with Θ sized n×V, especially for longer sentences.Future work may reduce the parameter count without affecting the optimality of generated examples.