Abstract
Deep neural networks (DNNs) are vulnerable to adversarial examples, which can mislead models without affecting normal judgment of humans. In the image field, such adversarial examples involve small perturbations that humans rarely notice. However, in the text domain, adversarial examples are more easily recognized due to the discrete nature of text. Existing textual adversarial attacks construct adversarial texts by replacing words or adding meaningless characters, often resulting in grammatical errors. In this paper, we propose a black-box attack method, Universal Tail Word Addition Attack (UTWAA), against textual sentiment analysis models. UTWAA adopts an ensemble strategy to select the most effective words for appending to the end of the original input, avoiding grammatical errors and making the adversarial texts less detectable by humans. We conduct extensive experiments on two datasets and six models; 10 volunteers are also invited to judge the generated texts. Results show that UTWAA achieves a high attack success rate with minimal word addition rate. By adding less than 4% of the words, the attack success rate exceeds 95%. Human evaluation indicates a 98% similarity between the adversarial texts and the original texts. Additionally, the method demonstrates good transferability in attacking state-of-the-art models.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Al-Dujaili, A., Huang, A., Hemberg, E., O’Reilly, U.: Adversarial deep learning for robust detection of binary encoded malware. In: 2018 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, 24 May 2018, pp. 76–82. IEEE Computer Society (2018). https://doi.org/10.1109/SPW.2018.00020
Azizi, A., et al.: T-miner: A generative approach to defend against trojan attacks on dnn-based text classification. In: Bailey, M.D., Greenstadt, R. (eds.) 30th USENIX Security Symposium, USENIX Security 2021, 11-13 August 2021, pp. 2255–2272. USENIX Association (2021), https://www.usenix.org/conference/usenixsecurity21/presentation/azizi
Beigi, G., Liu, H.: Similar but different: exploiting users’ congruity for recommendation systems. In: Thomson, R., Dancy, C., Hyder, A., Bisgin, H. (eds.) SBP-BRiMS 2018. LNCS, vol. 10899, pp. 129–140. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-93372-6_15
Blohm, M., Jagfeld, G., Sood, E., Yu, X., Vu, N.T.: Comparing attention-based convolutional and recurrent neural networks: Success and limitations in machine reading comprehension. In: Korhonen, A., Titov, I. (eds.) Proceedings of the 22nd Conference on Computational Natural Language Learning, CoNLL 2018, Brussels, Belgium, 31 October - 1 November 2018, pp. 108–118. Association for Computational Linguistics (2018). https://doi.org/10.18653/v1/k18-1011
Ebrahimi, J., Rao, A., Lowd, D., Dou, D.: Hotflip: White-box adversarial examples for text classification. In: Gurevych, I., Miyao, Y. (eds.) Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, ACL 2018, Melbourne, Australia, 15-20 July 2018, Volume 2: Short Papers, pp. 31–36. Association for Computational Linguistics (2018). https://aclanthology.org/P18-2006/
Gao, J., Lanchantin, J., Soffa, M.L., Qi, Y.: Black-box generation of adversarial text sequences to evade deep learning classifiers. In: 2018 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, 24 May 2018, pp. 50–56. IEEE Computer Society (2018). https://doi.org/10.1109/SPW.2018.00016
Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, 7-9 May 2015, Conference Track Proceedings, arXiv: 1412.6572 (2015)
Goyal, S., Doddapaneni, S., Khapra, M.M., Ravindran, B.: A survey of adversarial defenses and robustness in NLP. ACM Comput. Surv. 55(14s), 332:1–332:39 (2023). https://doi.org/10.1145/3593042
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, 27-30 June 2016, pp. 770–778. IEEE Computer Society (2016). https://doi.org/10.1109/CVPR.2016.90
He, R., McAuley, J.J.: Ups and downs: Modeling the visual evolution of fashion trends with one-class collaborative filtering. In: Bourdeau, J., Hendler, J., Nkambou, R., Horrocks, I., Zhao, B.Y. (eds.) Proceedings of the 25th International Conference on World Wide Web, WWW 2016, Montreal, Canada, 11 - 15 April 2016, pp. 507–517. ACM (2016), https://doi.org/10.1145/2872427.2883037
Hu, M., Zhang, X., Li, Y., Zhou, X., Luo, J.: St-ifgsm: enhancing robustness of human mobility signature identification model via spatial-temporal iterative FGSM. In: Singh, A.K., et al. (eds.) Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2023, Long Beach, CA, USA, 6-10 August 2023. pp. 764–774. ACM (2023), https://doi.org/10.1145/3580305.3599513
Kaya, Y.: The Limitations of Deep Learning Methods in Realistic Adversarial Settings. Ph.D. thesis, University of Maryland, College Park, MD, USA (2023). http://hdl.handle.net/1903/30868
Kretzer, M., Maedche, A.: Designing social nudges for enterprise recommendation agents: An investigation in the business intelligence systems context. J. Assoc. Inf. Syst. 19(12), 4 (2018), https://aisel.aisnet.org/jais/vol19/iss12/4
Lan, M., Zhang, Z., Lu, Y., Wu, J.: Three convolutional neural network-based models for learning sentiment word vectors towards sentiment analysis. In: 2016 International Joint Conference on Neural Networks, IJCNN 2016, Vancouver, BC, Canada, 24-29 July 2016. pp. 3172–3179. IEEE (2016). https://doi.org/10.1109/IJCNN.2016.7727604
Li, J., Tao, C., Peng, N., Wu, W., Zhao, D., Yan, R.: Evaluating and enhancing the robustness of retrieval-based dialogue systems with adversarial examples. In: Tang, J., Kan, M.-Y., Zhao, D., Li, S., Zan, H. (eds.) NLPCC 2019. LNCS (LNAI), vol. 11838, pp. 142–154. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-32233-5_12
Liang, B., Li, H., Su, M., Bian, P., Li, X., Shi, W.: Deep text classification can be fooled. In: Lang, J. (ed.) Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, IJCAI 2018, 13-19 July 2018, Stockholm, Sweden, pp. 4208–4215. ijcai.org (2018). https://doi.org/10.24963/ijcai.2018/585
Mikolov, T., Chen, K., Corrado, G., Dean, J.: Efficient estimation of word representations in vector space. In: Bengio, Y., LeCun, Y. (eds.) 1st International Conference on Learning Representations, ICLR 2013, Scottsdale, Arizona, USA, 2-4 May 2013, Workshop Track Proceedings, arXiv: 1301.3781 (2013)
Papernot, N., McDaniel, P.D., Swami, A., Harang, R.E.: Crafting adversarial input sequences for recurrent neural networks. In: Brand, J., Valenti, M.C., Akinpelu, A., Doshi, B.T., Gorsic, B.L. (eds.) 2016 IEEE Military Communications Conference, MILCOM 2016, Baltimore, MD, USA, 1-3 November 2016, pp. 49–54. IEEE (2016), https://doi.org/10.1109/MILCOM.2016.7795300
Pennington, J., Socher, R., Manning, C.D.: Glove: Global vectors for word representation. In: Moschitti, A., Pang, B., Daelemans, W. (eds.) Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing, EMNLP 2014, 25-29 October 2014, Doha, Qatar, A meeting of SIGDAT, a Special Interest Group of the ACL, pp. 1532–1543. ACL (2014). https://doi.org/10.3115/v1/d14-1162
Qing, Y., Bai, T., Liu, Z., Moulin, P., Wen, B.: Detection of adversarial attacks via disentangling natural images and perturbations. IEEE Trans. Inf. Forensics Secur. 19, 2814–2825 (2024). https://doi.org/10.1109/TIFS.2024.3352837
Qiu, S., Liu, Q., Zhou, S., Huang, W.: Adversarial attack and defense technologies in natural language processing: a survey. Neurocomputing 492, 278–307 (2022). https://doi.org/10.1016/j.neucom.2022.04.020
Qu, Y., et al.: Product-based neural networks for user response prediction over multi-field categorical data. ACM Trans. Inf. Syst. 37(1), 5:1–5:35 (2019).D https://doi.org/10.1145/3233770
Ren, S., Deng, Y., He, K., Che, W.: Generating natural language adversarial examples through probability weighted word saliency. In: Korhonen, A., Traum, D.R., Màrquez, L. (eds.) Proceedings of the 57th Conference of the Association for Computational Linguistics, ACL 2019, Florence, Italy, 28 July - 2 August 2019, Volume 1: Long Papers, pp. 1085–1097. Association for Computational Linguistics (2019). https://doi.org/10.18653/v1/p19-1103
Samanta, S., Mehta, S.: Generating adversarial text samples. In: Pasi, G., Piwowarski, B., Azzopardi, L., Hanbury, A. (eds.) ECIR 2018. LNCS, vol. 10772, pp. 744–749. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-76941-7_71
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: Bengio, Y., LeCun, Y. (eds.) 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, 14-16 April 2014, Conference Track Proceedings, arXiv: 1312.6199 (2014)
Xu, J., Yu, J., Liu, X., Meng, H.: Mixed precision DNN quantization for overlapped speech separation and recognition. In: IEEE International Conference on Acoustics, Speech and Signal Processing, ICASSP 2022, Virtual and Singapore, 23-27 May 2022. pp. 7297–7301. IEEE (2022). https://doi.org/10.1109/ICASSP43922.2022.9746885
Zhang, J., Cao, L., Lai, Q., Li, B., Qin, Y.: Bifrnet: a brain-inspired feature restoration DNN for partially occluded image recognition. In: Williams, B., Chen, Y., Neville, J. (eds.) Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on Innovative Applications of Artificial Intelligence, IAAI 2023, Thirteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2023, Washington, DC, USA, 7-14 February 2023, pp. 15296–15304. AAAI Press (2023), https://doi.org/10.1609/aaai.v37i12.26784
Zhang, Z., Ma, L., Liu, M., Chen, Y., Zhao, N.: Adversarial attacking and defensing modulation recognition with deep learning in cognitive-radio-enabled iot. IEEE Internet Things J. 11(8), 14949–14962 (2024). https://doi.org/10.1109/JIOT.2023.3345937
Zhu, H., Ren, Y., Liu, C., Sui, X., Zhang, L.: Frequency-based methods for improving the imperceptibility and transferability of adversarial examples. Appl. Soft Comput. 150, 111088 (2024). https://doi.org/10.1016/j.asoc.2023.111088
Zolfaghari, S., Suravee, S., Riboni, D., Yordanova, K.: Sensor-based locomotion data mining for supporting the diagnosis of neurodegenerative disorders: a survey. ACM Comput. Surv. 56(1), 10:1–10:36 (2024). https://doi.org/10.1145/3603495
Acknowledgments
This work was supported in part by Postdoctoral Research Foundation (No. DZ31000005), National Natural Science Foundation of China (Grant No. 62302445), National Natural Science Foundation of China (Grant No. 62372137), Guangxi Natural Science Foundation (No. 2022GXNSFBA035650), and the Major Key Project of PCL (Grant No. PCL2024AS102).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Xie, Y., Gu, Z., Tan, R., Luo, C., Song, X., Wang, H. (2024). Generating Adversarial Texts by the Universal Tail Word Addition Attack. In: Zhang, W., Tung, A., Zheng, Z., Yang, Z., Wang, X., Guo, H. (eds) Web and Big Data. APWeb-WAIM 2024. Lecture Notes in Computer Science, vol 14961. Springer, Singapore. https://doi.org/10.1007/978-981-97-7232-2_21
Download citation
DOI: https://doi.org/10.1007/978-981-97-7232-2_21
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-97-7231-5
Online ISBN: 978-981-97-7232-2
eBook Packages: Computer ScienceComputer Science (R0)