Strongly concealed adversarial attack against text classification models with limited queries

Area of Science:

• Natural Language Processing
• Machine Learning Security

Background:

• Adversarial attacks on text classification models struggle with generating valid samples, especially for long texts, due to high query requirements and semantic inconsistencies.
• Existing methods often rely on confidence vector differences or thesaurus-based generation, leading to inefficiency and low attack success rates.

Purpose of the Study:

• To propose a parallel and highly stealthy adversarial attack against text classification models (AdATCM) that overcomes limitations of existing methods.
• To improve the generation of adversarial samples that are semantically consistent and grammatically correct, increasing attack success rates.

Main Methods:

• AdATCM employs a dual-task approach for attack and generation, utilizing contextual information to determine word importance for distractor selection without querying the target model.
• An objective function integrating KL divergence loss, cross-entropy loss, and adversarial loss is used to train the attack model.
• The method generates adversarial samples that align with the original sample distribution.

Main Results:

• The proposed AdATCM demonstrates a high success rate in adversarial attacks against text classification models.
• The method significantly reduces the number of queries required, particularly for long texts, enhancing efficiency.
• Experimental results confirm the strong concealment and effectiveness of the proposed attack strategy.

Conclusions:

• The AdATCM provides an effective and stealthy approach for adversarial attacks in black-box scenarios, addressing key challenges in text classification.
• This method offers a significant improvement over existing techniques, especially in resource-constrained environments with limited queries and long text inputs.