Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

AED: An black-box NLP classifier model attacker

Yueyang Liu, Yan Huang, Zhipeng Cai

TL;DR

AED aims to test the robustness of NLP DNN models by interpretability their weaknesses and exploring alternative ways to optimize them by identifying vulnerabilities and providing explanations, which can improve the reliability and safety of DNN models in critical application areas such as healthcare and automated transportation.

Abstract

Deep Neural Networks (DNNs) have been successful in solving real-world tasks in domains such as connected and automated vehicles, disease, and job hiring. However, their implications are far-reaching in critical application areas. Hence, there is a growing concern regarding the potential bias and robustness of these DNN models. A transparency and robust model is always demanded in high-stakes domains where reliability and safety are enforced, such as healthcare and finance. While most studies have focused on adversarial image attack scenarios, fewer studies have investigated the robustness of DNN models in natural language processing (NLP) due to their adversarial samples are difficult to generate. To address this gap, we propose a word-level NLP classifier attack model called "AED," which stands for Attention mechanism enabled post-model Explanation with Density peaks clustering algorithm for synonyms search and substitution. AED aims to test the robustness of NLP DNN models by interpretability their weaknesses and exploring alternative ways to optimize them. By identifying vulnerabilities and providing explanations, AED can help improve the reliability and safety of DNN models in critical application areas such as healthcare and automated transportation. Our experiment results demonstrate that compared with other existing models, AED can effectively generate adversarial examples that can fool the victim model while maintaining the original meaning of the input.

AED: An black-box NLP classifier model attacker

TL;DR

AED aims to test the robustness of NLP DNN models by interpretability their weaknesses and exploring alternative ways to optimize them by identifying vulnerabilities and providing explanations, which can improve the reliability and safety of DNN models in critical application areas such as healthcare and automated transportation.

Abstract

Deep Neural Networks (DNNs) have been successful in solving real-world tasks in domains such as connected and automated vehicles, disease, and job hiring. However, their implications are far-reaching in critical application areas. Hence, there is a growing concern regarding the potential bias and robustness of these DNN models. A transparency and robust model is always demanded in high-stakes domains where reliability and safety are enforced, such as healthcare and finance. While most studies have focused on adversarial image attack scenarios, fewer studies have investigated the robustness of DNN models in natural language processing (NLP) due to their adversarial samples are difficult to generate. To address this gap, we propose a word-level NLP classifier attack model called "AED," which stands for Attention mechanism enabled post-model Explanation with Density peaks clustering algorithm for synonyms search and substitution. AED aims to test the robustness of NLP DNN models by interpretability their weaknesses and exploring alternative ways to optimize them. By identifying vulnerabilities and providing explanations, AED can help improve the reliability and safety of DNN models in critical application areas such as healthcare and automated transportation. Our experiment results demonstrate that compared with other existing models, AED can effectively generate adversarial examples that can fool the victim model while maintaining the original meaning of the input.
Paper Structure (12 sections, 9 equations, 4 figures, 2 tables, 1 algorithm)

This paper contains 12 sections, 9 equations, 4 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related works
  3. Attention Mechanism
  4. Word-level Textual Adversarial Attack
  5. Explainable AI
  6. Methodology
  7. Attention score-based word rank algorithm
  8. The density peaks clustering synonyms search algorithm
  9. Experiments
  10. Experiments Set
  11. Evaluation
  12. Conclusions and Future Work

Figures (4)

  • Figure 1: Attention Score-based Word Rank Model - Word Rank Model replicates Victim Model's predictions and adds explainability to the replicated model.
  • Figure 2: The accuracy of the IMDB dataset. The figure shows the accuracy of the two victim models (CNN/GRU) on the IMDB dataset with the AED attack model and random word replace attack(baseline).
  • Figure 3: The accuracy of the Amazon review dataset. The figure shows the accuracy of the two victim models (CNN/GRU) on the Amazon review dataset with the AED attack model and random word replace attack(baseline).
  • Figure 4: Sentence Similarity. The similarity score is calculated on Pearson Correlation Coefficient & Semantic Similarity