Modeling Adversarial Attack on Pre-trained Language Models as Sequential Decision Making
Pre-trained language models (PLMs) have been widely used to underpin various downstream tasks. However, the adversarial attack task has found that PLMs are vulnerable to small perturbations. Mainstream methods adopt a detached two-stage framework to attack without considering the subsequent influence of substitution at each step. In this paper, we formally model the adversarial attack task on PLMs as a sequential decision-making problem, where the whole attack process is sequential with two decision-making problems, i.e., word finder and word substitution. Considering the attack process can only receive the final state without any direct intermediate signals, we propose to use reinforcement learning to find an appropriate sequential attack path to generate adversaries, named SDM-Attack. Extensive experimental results show that SDM-Attack achieves the highest attack success rate with a comparable modification rate and semantic similarity to attack fine-tuned BERT. Furthermore, our analyses demonstrate the generalization and transferability of SDM-Attack. The code is available at https://github.com/fduxuan/SDM-Attack.
Code (1)
Tasks
Adversarial AttackDecision MakingSemantic SimilaritySemantic Textual SimilaritySequential Decision MakingMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Black-Box Attacks against RNN based Malware Detection Algorithms
Recent researches have shown that machine learning based malware detection algorithms are very vulnerable under the attacks of adversarial examples. These works mainly focused on the detection algorithms which use featur…
Malware DetectionAdaptive Adversarial Attack on Scene Text Recognition
Recent studies have shown that state-of-the-art deep learning models are vulnerable to the inputs with small perturbations (adversarial examples). We observe two critical obstacles in adversarial examples: (i) Strong adv…
Adversarial Attackimage-classificationImage ClassificationObject Detection+2Defending Substitution-Based Profile Pollution Attacks on Sequential Recommenders
While sequential recommender systems achieve significant improvements on capturing user dynamics, we argue that sequential recommenders are vulnerable against substitution-based profile pollution attacks. To demonstrate …
Adversarial AttackAdversarial DefenseRecommendation SystemsQuery-Efficient and Scalable Black-Box Adversarial Attacks on Discrete Sequential Data via Bayesian Optimization
We focus on the problem of adversarial attacks against models on discrete sequential data in the black-box setting where the attacker aims to craft adversarial examples with limited query access to the victim model. Exis…
Bayesian OptimizationVQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Models
Visual Question Answering (VQA) is a fundamental task in computer vision and natural language process fields. Although the ``pre-training & finetuning'' learning paradigm significantly improves the VQA performance, the a…
Adversarial RobustnessLanguage ModellingLarge Language ModelQuestion Answering+2