R&R: Metric-guided Adversarial Sentence Generation

TL;DR

This paper introduces R&R, a framework for generating high-quality adversarial sentences that are fluent, similar to original sentences, and effectively fool classifiers, improving robustness analysis of text models.

Contribution

The paper proposes a novel rewrite and rollback framework that optimizes a combined critique score to generate superior adversarial examples, balancing fluency, similarity, and misclassification.

Findings

Outperforms state-of-the-art in attack success rate by up to 16.2%

Effective across 5 datasets and 3 classifier architectures

Enhances the quality of adversarial examples in NLP tasks

Abstract

Adversarial examples are helpful for analyzing and improving the robustness of text classifiers. Generating high-quality adversarial examples is a challenging task as it requires generating fluent adversarial sentences that are semantically similar to the original sentences and preserve the original labels, while causing the classifier to misclassify them. Existing methods prioritize misclassification by maximizing each perturbation's effectiveness at misleading a text classifier; thus, the generated adversarial examples fall short in terms of fluency and similarity. In this paper, we propose a rewrite and rollback (R&R) framework for adversarial attack. It improves the quality of adversarial examples by optimizing a critique score which combines the fluency, similarity, and misclassification metrics. R&R generates high-quality adversarial examples by allowing exploration of perturbations that do not have immediate impact on the misclassification metric but can improve fluency and similarity metrics. We evaluate our method on 5 representative datasets and 3 classifier architectures. Our method outperforms current state-of-the-art in attack success rate by +16.2%, +12.8%, and +14.0% on the classifiers respectively. Code is available at https://github.com/DAI-Lab/fibber