Robustness of Misinformation Classification Systems to Adversarial Examples Through BeamAttack

TL;DR

This paper introduces BeamAttack, an advanced adversarial attack method that tests the robustness of text classification models against minimal, semantically-preserving modifications, revealing vulnerabilities in misinformation detection systems.

Contribution

The authors extend BeamAttack to include word deletions and skipping substitutions, and incorporate LIME for better word importance estimation, enhancing attack effectiveness and minimality.

Findings

Achieves over 99% attack success rate across models and datasets.

Effectively preserves semantic and lexical similarity of texts.

Highlights limitations of current robustness in misinformation classifiers.

Abstract

We extend BeamAttack, an adversarial attack algorithm designed to evaluate the robustness of text classification systems through word-level modifications guided by beam search. Our extensions include support for word deletions and the option to skip substitutions, enabling the discovery of minimal modifications that alter model predictions. We also integrate LIME to better prioritize word replacements. Evaluated across multiple datasets and victim models (BiLSTM, BERT, and adversarially trained RoBERTa) within the BODEGA framework, our approach achieves over a 99\% attack success rate while preserving the semantic and lexical similarity of the original texts. Through both quantitative and qualitative analysis, we highlight BeamAttack's effectiveness and its limitations. Our implementation is available at https://github.com/LucK1Y/BeamAttack